CVE-2026-3849: 
wolfSSL vulnerability analysis and mitigation

CVE-2026-3849 is a stack buffer overflow vulnerability in wolfSSL's Encrypted Client Hello (ECH) support, specifically in the wc_HpkeLabeledExtract function triggered via an oversized ECH config. It affects wolfSSL versions 5.6.0 through 5.8.4 (exclusive of 5.9.0), and can be exploited by a malicious TLS server to cause a stack buffer overflow on the client side, potentially leading to remote code execution or a client program crash. ECH support is disabled by default and must be explicitly enabled with the --enable-ech build option. The vulnerability was published on March 19, 2026, with a patch merged on March 11, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 6.9 (Medium) (Feedly, wolfSSL PR #9737).

The root cause is an out-of-bounds write (CWE-787) in the wc_HpkeLabeledExtract function within wolfSSL's HPKE (Hybrid Public Key Encryption) implementation used by ECH. When a TLS client with ECH enabled connects to a malicious server, the server can send a specially crafted ECH config with an oversized payload that exceeds the bounds of a stack-allocated buffer, causing a stack buffer overflow. Exploitation requires no authentication or user interaction, and is reachable over the network from any attacker-controlled TLS server. The fix was introduced via PR #9737, which included significant refactoring of ECH transcript and HPKE code (wolfSSL PR #9737, Feedly).

Successful exploitation allows a malicious TLS server to trigger a stack buffer overflow on a connecting wolfSSL client, potentially resulting in remote code execution within the client process or a denial-of-service crash. The vulnerability affects confidentiality, integrity, and availability at the highest level per CVSS v3.1 scoring. Impact is limited to clients that have explicitly compiled wolfSSL with --enable-ech and are connecting to attacker-controlled TLS servers; server-side deployments and clients without ECH enabled are not affected (Feedly).

1. Setup malicious TLS server: Configure a TLS server with ECH support enabled, capable of serving a crafted ECH config with an oversized payload in the HPKE wc_HpkeLabeledExtract input.
2. Lure or position the target client: Direct a wolfSSL client (compiled with --enable-ech, versions 5.6.0–5.8.4) to connect to the attacker-controlled server — for example, via DNS spoofing, BGP hijacking, or social engineering.
3. Deliver oversized ECH config: During the TLS handshake, respond with a maliciously crafted ECH config containing an oversized label or key material that exceeds the stack buffer allocated in wc_HpkeLabeledExtract.
4. Trigger stack buffer overflow: The client processes the ECH config without adequate bounds checking, causing the stack buffer to overflow and overwriting adjacent stack memory (return addresses, saved registers).
5. Achieve code execution or crash: Depending on stack layout and exploit precision, the attacker may redirect execution to attacker-controlled code (RCE) or cause the client process to crash (DoS) (Feedly, wolfSSL PR #9737).

• Process: Unexpected crashes or segmentation faults in applications using wolfSSL with ECH enabled; core dumps from TLS client processes during handshake with ECH-capable servers.
• Logs: Application logs showing TLS handshake failures or abrupt termination when connecting to servers advertising ECH support; error messages referencing HPKE or ECH config parsing.
• Network: Outbound TLS connections to unfamiliar or unexpected servers by applications using wolfSSL; servers advertising ECH configs with unusually large extension sizes in TLS ClientHello/ServerHello captures.
• File System: Unexpected core dump files generated by wolfSSL-linked client applications in working directories or /var/crash.

Upgrade wolfSSL to version 5.9.0 or later, which contains the fix merged via PR #9737 on March 11, 2026 (wolfSSL PR #9737). If immediate patching is not feasible, disable ECH support by rebuilding wolfSSL without the --enable-ech configuration flag — ECH is off by default, so unmodified builds are not affected. Additionally, restrict TLS client connections to trusted servers only, as exploitation requires a malicious TLS server. Monitor wolfSSL 5.6.0–5.8.4 deployments with ECH enabled for unexpected crashes or anomalous TLS handshake behavior (Feedly).

The vulnerability received routine coverage from automated CVE tracking services and security aggregators shortly after publication in March 2026, including mentions on Bluesky CVE feeds and radar/threat intelligence platforms (Feedly). A Tenable Nessus plugin (ID 303183) was published to detect affected wolfSSL versions. No notable researcher commentary, vendor blog posts, or significant social media discussion beyond automated feeds has been identified for this CVE.