Session Resumption Vulnerability in wolfSSL Affects Secure Communication

CVE-2026-11703

What is CVE-2026-11703?

This vulnerability in the wolfSSL library occurs due to missing Server Name Indication (SNI) and Application-Layer Protocol Negotiation (ALPN) binding during the stateful session-ID resumption. Previously, when a session was resumed using a ticket, the binding check was skipped, allowing a cached session to be resumed under a different SNI/ALPN than originally established. This could lead to situations where a cached peer-authentication state was carried over into a context that it was not meant for, potentially breaching security between different virtual hosts. The latest updates introduce verification of the SNI/ALPN binding for all resumption paths, reverting to a full handshake procedure when mismatches occur, thereby enhancing protocol security.

References