CVE-2026-3849 PUBLISHED

Buffer Overflow in HPKE via Oversized ECH Config

Assigner: wolfSSL
Reserved: 09.03.2026 Published: 19.03.2026 Updated: 19.03.2026

Stack Buffer Overflow in wc_HpkeLabeledExtract via Oversized ECH Config. A vulnerability existed in wolfSSL 5.8.4 ECH (Encrypted Client Hello) support, where a maliciously crafted ECH config could cause a stack buffer overflow on the client side, leading to potential remote execution and client program crash. This could be exploited by a malicious TLS server supporting ECH. Note that ECH is off by default, and is only enabled with enable-ech.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/V:D/RE:M/U:Amber
CVSS Score: 6.9

Product Status

Vendor wolfSSL Inc.
Product wolfSSL
Versions Default: unaffected
  • affected from v5.6.0-stable to v5.8.4-stable (incl.)

Credits

  • Haruto Kimura (Stella) finder

References

Problem Types

  • CWE-787: Out-of-bounds Write CWE