CVE-2026-5503: 
wolfSSL vulnerability analysis and mitigation

CVE-2026-5503 is a heap buffer overflow vulnerability in wolfSSL's Encrypted Client Hello (ECH) and Server Name Indication (SNI) processing, classified as an out-of-bounds write (CWE-787). The flaw exists in the TLSX_EchChangeSNI function and affects wolfSSL versions up to and including 5.9.0. It was published on April 9, 2026, with a patch merged into the wolfSSL master branch on April 6, 2026, targeting release 5.9.2. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, wolfSSL PR #10102).

The root cause is an unconditional assignment in TLSX_EchChangeSNI: the ctx->extensions branch sets extensions even when TLSX_Find returns NULL, allowing an attacker-controlled publicName to be attached to the shared WOLFSSL_CTX when no inner SNI is configured (CWE-787). Because TLSX_EchRestoreSNI only removes the SNI when serverNameX != NULL, the injected publicName is never cleaned up. The inner ClientHello is sized before this pollution occurs but written after it, causing TLSX_SNI_Write to memcpy 255 bytes past the allocated buffer boundary. The fix, reported by Nicholas Carlini (Anthropic) and Thai Duong (Calif.io), mirrors the guarded pattern of the ssl->extensions branch, moves TLSX_Remove outside the serverNameX guard, and returns BAD_FUNC_ARG when ECH is used without an inner SNI (wolfSSL PR #10102, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to corrupt heap memory by writing 255 bytes past an allocation boundary during TLS handshake processing. This can result in application crashes (denial of service) or, in more severe scenarios, arbitrary code execution depending on heap layout and memory allocator behavior. The vulnerability requires no user interaction or elevated privileges, and affects any application using wolfSSL ≤ 5.9.0 with ECH enabled (GitHub Advisory, wolfSSL PR #10102).

No public proof-of-concept exploit code has been reported, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability was discovered and reported by Nicholas Carlini (Anthropic) and Thai Duong (Calif.io) as part of coordinated vulnerability research. The EPSS score is approximately 0.042–0.053%, placing it in the 17th percentile for exploitation likelihood within 30 days. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify target: Locate a server or client application using wolfSSL ≤ 5.9.0 compiled with ECH (Encrypted Client Hello) support enabled.
2. Craft malicious ClientHello: Construct a TLS ClientHello message that includes an ECH extension with an attacker-controlled publicName value, but without a corresponding inner SNI configured.
3. Trigger SNI pollution: Send the crafted ClientHello to the target. In TLSX_EchChangeSNI, the ctx->extensions branch unconditionally sets extensions even though TLSX_Find returns NULL, causing TLSX_UseSNI to attach the attacker-controlled publicName to the shared WOLFSSL_CTX.
4. Bypass cleanup: Because TLSX_EchRestoreSNI only removes the SNI when serverNameX != NULL, the injected publicName persists in the context.
5. Trigger out-of-bounds write: The inner ClientHello is sized before the pollution but written after it. When TLSX_SNI_Write executes, it performs a memcpy of 255 bytes past the allocated buffer boundary, corrupting adjacent heap memory.
6. Achieve objective: Depending on heap layout, this corruption may crash the application (DoS) or be leveraged for arbitrary code execution (wolfSSL PR #10102, GitHub Advisory).

• Network: Unexpected or malformed TLS ClientHello messages containing ECH extensions with unusual publicName values targeting services using wolfSSL; repeated TLS handshake failures from a single source IP.
• Logs: Application logs showing TLS handshake errors or crashes during ECH/SNI processing; wolfSSL error codes related to BAD_FUNC_ARG or memory faults in ECH-related functions.
• Process: Unexpected application crashes or core dumps in processes using wolfSSL, particularly during TLS handshake phases; heap corruption signals such as SIGABRT or SIGSEGV from memory allocator integrity checks (e.g., glibc heap corruption detected).
• File System: Core dump files generated by wolfSSL-linked applications following unexpected termination during TLS processing.

The primary remediation is to upgrade wolfSSL to version 5.9.2 or later, which includes the fix merged in pull request #10102 on April 6, 2026 (wolfSSL PR #10102). If immediate patching is not feasible, consider disabling ECH support at compile time if it is not required by the application. Additionally, implementing network-level controls to restrict TLS traffic from untrusted sources can reduce exposure. Monitor for application crashes or unexpected behavior that may indicate exploitation attempts.

The vulnerability was discovered by Nicholas Carlini (Anthropic) and Thai Duong (Calif.io) as part of AI-assisted security research, with Anthropic credited for the finding (wolfSSL PR #10102). VulnCheck published a blog post referencing Anthropic Glasswing CVEs, which includes this vulnerability, highlighting the role of AI in identifying cryptographic library flaws (VulnCheck Blog). The vulnerability was also discussed on the oss-security mailing list (oss-sec). Anthropic published details of the finding through their red team disclosure program.