CVE-2026-6679CWE-190CWE-197CWE-787

DTLS 1.3 ACK serialization heap buffer overflow via integer truncation

High · published June 25, 2026

CVSS v4.0
8.8
EPSS
1%
Percentile
42.2
In the wild
Unconfirmed
What it is

A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized buffer to be allocated and then overrun. This affects builds using DTLS 1.3 and wolfSSL version 5.9.0 and earlier. A fix was added to the 5.9.1 release.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
EPSS
0.00505 · 42.2th percentile
Weaknesses
CWE-190 · Integer Overflow or Wraparound; CWE-197 · Numeric Truncation Error; CWE-787 · Out-of-bounds Write
Published
2026-06-25T20:13Z
EPSS history
Timeline
  • 25 JUN 20:13Z
    DTLS 1.3 ACK serialization heap buffer overflow via integer truncation
    cvelistv5