CVE-2026-5503: wolfSSL out-of-bounds write in TLSX_EchChangeSNI (ECH SNI handling)
wolfSSL versions up to and including 5.9.0 contain an out-of-bounds write in a code path related to Encrypted Client Hello SNI handling, where attacker-controlled data can persist in a shared context when no inner SNI is configured. NVD rates the issue 9.1 (critical), and the record lists no confirmed exploitation in the sources consulted. No fixed version appears in the record, so administrators should monitor the vendor and the referenced pull request.
Overview
CVE-2026-5503 is an out-of-bounds write classified as CWE-787 in wolfSSL. According to the record, the TLSX_EchChangeSNI code path can leave an attacker-controlled publicName in a shared context when no inner SNI is configured, and the cleanup step does not remove it, so a later write can run 255 bytes past an allocation boundary.
Impact
The NVD base score is 9.1 (critical). The listed vector describes a network attack requiring no privileges and no user interaction, with high integrity and availability impact and no confidentiality impact. wolfSSL provides its own score of 6.9. The record does not describe consequences beyond these ratings, so the practical impact in a specific deployment is unknown.
Affected products and versions
- Product: wolfSSL Wolfssl
- Affected: up to and including 5.9.0
- Fixed versions: none listed in the record
The record includes one issue-tracking reference, a pull request in the wolfSSL repository. It does not confirm which releases contain the change.
Exploitation status
The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. SSVC lists exploitation as none and automatable as yes. The EPSS probability is 0.00452 with a percentile of 0.3835.
Remediation and mitigation
- Inventory systems and products that embed wolfSSL at version 5.9.0 or earlier.
- Monitor the vendor and the referenced pull request for a release that includes the change. The record does not identify one.
- If Encrypted Client Hello support is not required, review whether it is enabled in your build. This is an inference based on the function names involved.
- Limit exposure of TLS endpoints built with affected versions until a fixed release is verified.
Detection guidance
- Watch TLS services that use wolfSSL for unexpected crashes, memory errors or abnormal terminations, which may accompany memory corruption.
- Review TLS handshake logs for unusual server name or extension values where your platform exposes them.
Limitations of the available information
The record does not list fixed versions, vendor advisory text, or confirmed exploitation details. Whether a particular deployment is reachable under the conditions in the description is unknown.
Frequently asked questions
Which wolfSSL versions are affected by CVE-2026-5503?
The record lists wolfSSL versions up to and including 5.9.0 as affected. It does not list a fixed version.
Is CVE-2026-5503 known to be exploited in the wild?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
What should administrators do now?
Inventory wolfSSL usage, monitor the vendor and the referenced pull request for a fixed release, and limit exposure of affected TLS endpoints until a fix is verified.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.