EUVD-2026-39576
GHSA-q3px-vrjj-4f97
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires multi-vhost server with divergent client-auth policies and an existing session (PR:L, AC:H); authentication bypass yields integrity impact only, with no confidentiality or availability effect.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
Lifecycle Timeline
2DescriptionCVE.org
Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual hosts, carry the cached peer-authentication state into a context it was not established for. Resumption now verifies the SNI/ALPN binding for all paths and declines (falling back to a full handshake) on mismatch.
AnalysisAI
Session authentication bypass in wolfSSL exposes servers running multiple TLS virtual hosts to cross-vhost peer-authentication spoofing via stateful session-ID resumption. When a client resumes a cached session using a session ID rather than a session ticket, wolfSSL previously skipped the SNI and ALPN binding verification that was already enforced on the ticket-based resumption path - allowing the cached peerAuthGood state and peer-certificate context from one virtual host to be silently carried into a second virtual host with a different client-authentication policy. The upstream fix (PR #10489) extends the binding check to cover stateful resumption, declining mismatched resumptions and falling back to a full handshake. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 6.0 with AC:H and AT:P reflects the non-trivial configuration prerequisites.
Technical ContextAI
wolfSSL is a lightweight, embedded TLS library (cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*) commonly used in IoT, automotive, and resource-constrained environments. TLS session resumption has two forms: stateful (session-ID, where the server caches session state) and stateless (session tickets, where state is encrypted in a client-held token). RFC 6066 Section 3 requires that SNI be bound to the resumed session; similarly, ALPN negotiation is protocol-specific. The root cause is CWE-287 (Improper Authentication): the SNI hash comparison (TicketSniHash) and ALPN hash comparison (TicketAlpnHash) existed and were called for ticket-based resumption via VerifyTicketBinding(), but the equivalent check inside HandleTlsResumption for the session-ID path was absent. The diff in PR #10489 adds an explicit SNI/ALPN hash comparison in the stateful resumption code path (guarded by HAVE_SESSION_TICKET && (HAVE_SNI || HAVE_ALPN) preprocessor flags) before the server commits to resumption, declining and clearing ssl->options.resuming on mismatch, consistent with RFC 6066 fallback semantics.
RemediationAI
The upstream fix is available in wolfSSL GitHub pull request #10489 (https://github.com/wolfSSL/wolfssl/pull/10489); however, a tagged release version incorporating this fix has not been independently confirmed from the available intelligence - upgrade to the first wolfSSL release published after PR #10489 is merged. Until a patched release is available or deployed, two compensating controls are available with associated trade-offs: first, disable stateful session-ID resumption entirely so that only ticket-based resumption (which already performs the binding check) remains active - this removes the vulnerable code path entirely but increases handshake overhead for reconnecting clients since each connection will perform a full handshake; second, ensure that all virtual hosts served by the wolfSSL instance enforce an identical client-authentication policy (all requiring mutual TLS or none requiring it), which eliminates the exploitable policy differential even if the binding bypass is triggered - but this may conflict with application requirements where different vhosts intentionally differ on mTLS enforcement. Monitor https://www.wolfssl.com/docs/security-vulnerabilities/ for the official advisory and confirmed fix version.
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange i
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or tra
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. Rated high severity (
An issue was discovered in wolfSSL before 5.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Ra
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Rated high severity (CVSS 7.0).
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in t
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CR
An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is e
wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request di
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today