What is the CVSS score of CVE-2026-3547?

CVE-2026-3547 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Nginx are affected by CVE-2026-3547?

wolfSSL versions 5.8.4 and earlier contain a vulnerability that could allow attackers to crash systems running affected software, resulting in service disruptions.. A patch is available.

How to fix or mitigate CVE-2026-3547?

Within 24 hours: Identify all systems running wolfSSL 5.8.4 or earlier with ALPN enabled and confirm whether they use affected third-party integrations (Apache, Nginx, HAProxy, BIND, Curl, etc.). Within 7 days: Test and deploy available patches in non-production environments. Within 30 days: Complete production deployment of patched wolfSSL versions across all affected systems.

Nginx CVE-2026-3547

EUVD-2026-13166 HIGH

Out-of-bounds Read (CWE-125)

2026-03-19 wolfSSL

Buffer Overflow Denial Of Service Nginx Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 21:00 euvd

EUVD-2026-13166

Analysis Generated

Mar 19, 2026 - 21:00 vuln.today

Patch released

Mar 19, 2026 - 21:00 nvd

Patch available

CVE Published

Mar 19, 2026 - 20:20 nvd

HIGH 7.5

DescriptionCVE.org

Out-of-bounds read in ALPN parsing due to incomplete validation. wolfSSL 5.8.4 and earlier contained an out-of-bounds read in ALPN handling when built with ALPN enabled (HAVE_ALPN / --enable-alpn). A crafted ALPN protocol list could trigger an out-of-bounds read, leading to a potential process crash (denial of service). Note that ALPN is disabled by default, but is enabled for these 3rd party compatibility features: enable-apachehttpd, enable-bind, enable-curl, enable-haproxy, enable-hitch, enable-lighty, enable-jni, enable-nginx, enable-quic.

AnalysisAI

Denial of service in Nginx via out-of-bounds read during ALPN protocol parsing when ALPN support is enabled, allowing unauthenticated remote attackers to crash the process by sending a crafted ALPN list. This vulnerability affects Nginx and other third-party applications that have compiled wolfSSL 5.8.4 or earlier with ALPN enabled. A patch is available to address this incomplete validation flaw.

Technical ContextAI

wolfSSL is a lightweight TLS/SSL library written in C that provides secure communication capabilities for embedded systems and IoT devices. The vulnerability (CWE-125: Out-of-bounds Read) occurs in the ALPN extension handling code, where insufficient validation of the ALPN protocol list length allows reading beyond allocated buffer boundaries. ALPN is a TLS extension that enables clients and servers to negotiate application protocols during the TLS handshake. The affected product is identified by CPE cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:* for versions prior to 5.9.0. The vulnerability manifests when wolfSSL is compiled with HAVE_ALPN defined or --enable-alpn flag, which happens automatically for integrations with nginx, Apache, HAProxy, cURL, BIND, Lighttpd, Hitch, JNI, and QUIC implementations.

RemediationAI

Upgrade wolfSSL to version 5.9.0 or later, which contains the fix merged in GitHub pull request 9859 (https://github.com/wolfSSL/wolfssl/pull/9859). Organizations unable to immediately upgrade should recompile wolfSSL without ALPN support if the feature is not required, though this may break compatibility with certain third-party integrations. For systems that must retain ALPN functionality before patching, implement network-level controls to filter malformed TLS handshakes and monitor for unusual connection patterns or service crashes. The vendor has confirmed the patch availability, making upgrade the preferred remediation path.