Executive brief
wolfSSL is a security library used by applications to provide encrypted communications. A flaw in how it handles modern 'post-quantum' encryption during the initial connection phase could allow an attacker to cause a crash or memory corruption. This could lead to a denial-of-service, impacting the availability of services that rely on wolfSSL for secure networking.
Technical details
A heap use-after-free vulnerability exists in wolfSSL's TLS 1.3 implementation within the post-quantum cryptography (PQC) hybrid KeyShare processing logic. Specifically, in the error handling path of TLSX_KeyShare_ProcessPqcHybridClient() located in src/tls.c, the inner function TLSX_KeyShare_ProcessPqcClient_ex() may free a KyberKey object upon encountering an error. The calling function subsequently invokes TLSX_KeyShare_FreeAll(), which attempts to call ForceZero() on the already-freed KyberKey pointer. This results in zero bytes being written over freed heap memory. An unauthenticated remote attacker can trigger this condition during the TLS handshake. The issue is addressed in wolfSSL version 5.9.1.
Affected products
- wolfSSL wolfSSL up to (excluding) 5.9.1
Timeline
- 2026-03-30: patched: Fix merged into wolfSSL master branch via PR 10092.
- 2026-04-10: disclosed: Initial CVE publication.
- 2026-04-29: advisory: NIST NVD analysis completed.