Skip to content
OpenAdvisories
Low · 2.3 CVE-2026-15442 EUVD-2026-87924GHSA-rjf7-5h4x-wj8p

Heap use-after-free on read during bidirectional (D)TLS shutdown

Published Sep 27, 2026 · Updated Sep 30, 2026 · Assigned by wolfSSL

Description

In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a heap-use-after free. If an application ended up getting a partial wolfSSL_read() which is sometimes caused by a small user buffer passed in, then called wolfSSL_shutdown for a bidirectional close and attempted to wolfSSL_read() again while the peer continues trying to send data during the shutdown it would lead to a state where a potential heap-use-after free happened.

Affected products

VendorProductAffectedFixed
wolfSSL wolfSSL 4.4.0 – ≤ 5.9.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 wolfssl No fix yet —
Debian 12 wolfssl No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 wolfssl No fix yet —
Ubuntu 26.04 LTS wolfssl No fix yet —
Ubuntu 24.04 LTS wolfssl No fix yet —
Ubuntu 22.04 LTS wolfssl No fix yet —
Ubuntu 20.04 LTS wolfssl No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS wolfssl No fix yet —
Ubuntu 16.04 LTS wolfssl No fix yet —
ReleasePackageFixed inAdvisory
Alpine v3.24 wolfssl 5.9.4-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 mariadb No fix yet —

References