What’s Vulnerable › Vulnerabilities

CVE-2026-6679: DTLS 1.3 ACK serialization heap buffer overflow via integer truncation

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-25 · updated 2026-06-27
• Weakness: CWE-190

Description

A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized buffer to be allocated and then overrun. This affects builds using DTLS 1.3 and wolfSSL version 5.9.0 and earlier. A fix was added to the 5.9.1 release.

Affected products

• wolfSSL: from 5.4.0 before 5.9.1 — fixed in 5.9.1

How to fix

Upgrade to a fixed version: wolfSSL 5.9.1. Check the vendor advisory for mitigations.

References

• https://github.com/wolfSSL/wolfssl/pull/10116
• https://www.wolfssl.com/docs/security-vulnerabilities/

Get alerted when CVE-2026-6679 or the next vulnerability affects your stack