Session Cache Vulnerability in wolfSSL by wolfSSL, Inc.

CVE-2026-94419

What is CVE-2026-94419?

The wolfSSL library exposes a session cache vulnerability that allows an attacker to impersonate a legitimate server during TLS 1.2 and DTLS 1.2 connections. This occurs when the session cache is improperly configured, enabling an attacker to overwrite a client's session entry with a malicious server's details. Affected builds lack critical cache configuration settings, allowing unauthorized sessions to persist across WOLFSSL_CTX boundaries. Inadequate validation during session resumption leads to potential man-in-the-middle attacks, as the compromised session can be reused by attackers without proper certificate verification. To mitigate these risks, users are advised to implement the latest fixes which enhance cache handling and version control.

References