Memory Corruption Issue in TLS 1.3 Client by Eclipse Foundation

CVE-2026-103415

What is CVE-2026-103415?

A vulnerability exists in the TLS 1.3 client implementation by Eclipse Foundation where a HelloRetryRequest can lead to memory corruption. When the client receives this request, it inadvertently copies the server's cookie into its second ClientHello message without proper validation of the cookie's size. This allows a malicious or compromised server to potentially overwrite memory beyond the intended buffer limits, which occurs prior to certificate authentication. Consequently, this flaw could be exploited to manipulate client memory, potentially leading to further vulnerabilities.

References