CVE-2026-3849: wolfSSL Buffer Overflow Vulnerability

CVE-2026-3849 Overview

A stack buffer overflow vulnerability exists in wolfSSL 5.8.4 within the wc_HpkeLabeledExtract function when processing Encrypted Client Hello (ECH) configurations. When a maliciously crafted oversized ECH config is received from a TLS server, the vulnerability triggers a stack buffer overflow on the client side. This can lead to potential remote code execution or cause the client program to crash.

The vulnerability is exploitable by a malicious TLS server that supports ECH. However, it's important to note that ECH support is disabled by default in wolfSSL and must be explicitly enabled using the --enable-ech build option, which limits the attack surface.

Critical Impact
A malicious TLS server can exploit this stack buffer overflow to potentially achieve remote code execution on vulnerable wolfSSL clients with ECH enabled, or cause denial of service through client program crashes.

Affected Products

wolfSSL 5.8.4 with ECH enabled (--enable-ech)
Applications built against wolfSSL 5.8.4 with ECH support compiled in
TLS clients utilizing wolfSSL's Encrypted Client Hello functionality

Discovery Timeline

2026-03-19 - CVE-2026-3849 published to NVD
2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-3849

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-bounds Write), specifically manifesting as a stack buffer overflow. The flaw resides in the wc_HpkeLabeledExtract function, which is part of wolfSSL's HPKE (Hybrid Public Key Encryption) implementation used by ECH.

When processing an ECH configuration received from a TLS server, the function fails to properly validate the size of the incoming configuration data before copying it to a fixed-size stack buffer. An attacker controlling a malicious TLS server can craft an oversized ECH config that exceeds the expected buffer boundaries, causing memory corruption on the stack.

The network-based attack vector with low complexity means that exploitation does not require authentication or user interaction, though the scope is limited by the requirement that ECH must be explicitly enabled on the client.

Root Cause

The root cause is insufficient bounds checking in the wc_HpkeLabeledExtract function when handling ECH configuration data. The function allocates a fixed-size buffer on the stack to process HPKE labeled extraction operations. When the ECH config exceeds the expected maximum size, the function copies data beyond the buffer boundaries, corrupting adjacent stack memory.

This type of vulnerability typically occurs when:

Input length validation is missing or inadequate
Fixed-size stack buffers are used without proper size constraints
The code trusts externally-provided length fields without verification

Attack Vector

The attack requires a malicious TLS server that supports ECH. When a vulnerable wolfSSL client initiates a TLS connection with ECH enabled, the server can respond with a specially crafted ECH configuration containing an oversized payload.

The attack flow involves the client connecting to a malicious TLS server, which then sends a crafted ECH configuration with excessive size. When the client processes this configuration via wc_HpkeLabeledExtract, the oversized data overflows the stack buffer. Depending on the overflow contents, this results in either remote code execution or a client crash.

Since the vulnerability requires the target to connect to a malicious server, practical exploitation scenarios include DNS spoofing to redirect legitimate connections, man-in-the-middle attacks on initial connections, or watering hole attacks where victims are lured to attacker-controlled servers.

Detection Methods for CVE-2026-3849

Indicators of Compromise

Unexpected crashes in applications using wolfSSL with ECH enabled
Stack corruption or buffer overflow exceptions in TLS client processes
Unusual network connections to suspicious TLS servers from ECH-enabled clients
Core dumps showing memory corruption patterns in wolfSSL-related stack frames

Detection Strategies

Monitor for crash events in applications built with wolfSSL 5.8.4 that have ECH support
Deploy network intrusion detection rules to identify anomalously large ECH configurations in TLS handshakes
Implement application-level monitoring for stack canary violations or buffer overflow protections triggering
Review build configurations to identify systems where --enable-ech was used

Monitoring Recommendations

Enable verbose logging on TLS client applications to capture ECH configuration details
Configure crash reporting systems to alert on wolfSSL-related stack buffer overflow crashes
Monitor network traffic for TLS connections with unusually large server hello or ECH-related extensions
Implement endpoint detection for memory corruption indicators in wolfSSL client processes

How to Mitigate CVE-2026-3849

Immediate Actions Required

Identify all applications built with wolfSSL 5.8.4 where ECH support is enabled
Disable ECH functionality temporarily by rebuilding without --enable-ech if not required
Apply the security patch referenced in the wolfSSL GitHub Pull Request #9737
Prioritize patching for internet-facing TLS client applications

Patch Information

The wolfSSL team has addressed this vulnerability in Pull Request #9737. Organizations should upgrade to the patched version of wolfSSL as soon as it becomes available in an official release. The patch adds proper bounds checking to the wc_HpkeLabeledExtract function to prevent oversized ECH configurations from causing buffer overflows.

Workarounds

Rebuild wolfSSL without ECH support by omitting the --enable-ech configuration flag
Implement network-level filtering to block or inspect ECH configurations exceeding expected sizes
Deploy compile-time stack protection mechanisms (stack canaries, ASLR) to mitigate exploitation
Restrict outbound TLS connections to trusted servers where possible to reduce exposure to malicious ECH configs

bash

# Configuration example - Rebuild wolfSSL without ECH support
./configure --disable-ech
make clean
make
make install