CVE-2026-3549: 
wolfSSL vulnerability analysis and mitigation

CVE-2026-3549 is a heap-based buffer overflow vulnerability in wolfSSL's TLS 1.3 Encrypted Client Hello (ECH) extension parsing logic. An integer underflow in TLSX_ECH_Parse() when calculating a buffer length from the attacker-controlled innerClientHelloLen field causes writes beyond the bounds of an allocated heap buffer. All wolfSSL versions prior to 5.9.0 are affected when ECH is explicitly enabled (ECH is disabled by default). The vulnerability was disclosed on March 19, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.3 (High) (Feedly, wolfSSL PR #9817).

The root cause is an integer underflow (CWE-122: Heap-based Buffer Overflow) in TLSX_ECH_Parse() within src/tls.c. When parsing the innerClientHelloLen field of a TLS 1.3 ECH extension, the code subtracts WC_AES_BLOCK_SIZE (16 bytes) from the attacker-supplied innerClientHelloLen value without first verifying that the value is large enough. If innerClientHelloLen is between 0 and 15, the subtraction wraps around a word16 (unsigned 16-bit integer) to approximately 65,520, causing a subsequent XMEMSET to write far beyond the allocated buffer boundary and wc_AesGcmDecrypt to over-read the heap. The fix adds a bounds check before the subtraction, returning BUFFER_ERROR if the field is too small (wolfSSL PR #9817). Exploitation requires that ECH has been explicitly enabled in the wolfSSL build, which is not the default configuration (Feedly).

Successful exploitation can result in denial of service (process crash), sensitive information disclosure from heap memory, or remote code execution — all achievable by a network-adjacent attacker without authentication or user interaction. The vulnerability affects the confidentiality, integrity, and availability of any application embedding wolfSSL with ECH enabled, including embedded systems, IoT devices, and server-side TLS endpoints. Because wolfSSL is widely used in resource-constrained environments, a heap overflow in the TLS handshake path could enable an attacker to pivot further into a network or compromise cryptographic material (Feedly).

1. Reconnaissance: Identify services using wolfSSL versions prior to 5.9.0 with ECH explicitly enabled, using TLS fingerprinting tools (e.g., jarm, tlsx) or by inspecting application documentation and build configurations.
2. Craft malicious TLS ClientHello: Construct a TLS 1.3 ClientHello packet containing a malformed ECH extension where the innerClientHelloLen field is set to a value between 0 and 15 (e.g., 0x00 or 0x0F).
3. Trigger integer underflow: Send the crafted packet to the target server. The vulnerable TLSX_ECH_Parse() function subtracts WC_AES_BLOCK_SIZE (16) from the small innerClientHelloLen value, causing a word16 underflow to ~65,520.
4. Heap buffer overflow: The underflowed length is passed to XMEMSET, writing zeros far beyond the allocated buffer on the heap, corrupting adjacent heap metadata or data structures.
5. Achieve objective: Depending on heap layout and target platform, the attacker may cause a crash (DoS), leak adjacent heap contents (information disclosure), or achieve code execution by overwriting function pointers or other control-flow data (wolfSSL PR #9817, Feedly).

• Network: Unexpected or malformed TLS 1.3 ClientHello packets containing ECH extensions with anomalously small innerClientHelloLen values (0–15); repeated TLS handshake failures from a single source IP targeting ECH-enabled endpoints.
• Logs: TLS library error logs showing BUFFER_ERROR or unexpected handshake termination during ECH parsing; application crash logs or core dumps originating from wolfSSL's TLSX_ECH_Parse() or wc_AesGcmDecrypt() functions.
• Process: Unexpected process crashes or restarts of services using wolfSSL; heap corruption signals such as SIGABRT or SIGSEGV from the TLS service process.
• File System: Core dump files generated by the TLS service process following unexpected termination (wolfSSL PR #9817).

The primary remediation is to upgrade wolfSSL to version 5.9.0 or later, which includes the fix merged on February 26, 2026 (wolfSSL PR #9817). If immediate patching is not feasible, ensure that ECH support remains disabled (the default configuration), which eliminates the attack surface entirely. Additionally, implement network segmentation to restrict TLS traffic to trusted endpoints, and monitor for unusual TLS handshake failures or service crashes that may indicate exploitation attempts (Feedly).

The vulnerability was discovered through static code analysis using wolfSSL's internal Fenrir tooling and was reported and fixed by wolfSSL team member LinuxJedi (wolfSSL PR #9817). A Bluesky post from a CVE tracking account noted the disclosure shortly after publication. Coverage has been limited to automated vulnerability databases and aggregators, consistent with the low exploitation risk due to ECH being disabled by default (Feedly).