ZeroDay Findings
Sign inSign up

Findings

CVE-2026-5507

When restoring a session from cache, a pointer from the serialized session data is used in a free operation without validation.

Published Apr 9, 2026 · updated Jun 17, 2026 · wolfssl wolfssl

When restoring a session from cache, a pointer from the serialized session data is used in a free operation without validation. An attacker who can poison the session cache could trigger an arbitrary free. Exploitation requires the ability to inject a crafted session into the cache and for the application to call specific session restore APIs.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 9, 2026 · NIST NVD

    Detected

    When restoring a session from cache, a pointer from the serialized session data is used in a free operation without validation. An attacker who can poison the session cache could trigger an arbitrary free. Exploitation requires the ability to inject a crafted session into the cache and for the application to call specific session restore APIs.

  2. Jun 17, 2026 · NIST NVD

    Updated

    When restoring a session from cache, a pointer from the serialized session data is used in a free operation without validation. An attacker who can poison the session cache could trigger an arbitrary free. Exploitation requires the ability to inject a crafted session into the cache and for the application to call specific session restore APIs.

Affected

  • cpe wolfssl/wolfsslversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-5507

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-5507

    When restoring a session from cache, a pointer from the serialized session data is used in a free operation without validation. An attacker who can poison the session cache could trigger an arbitrary free. Exploitation requires the ability to inject a crafted session into the cac

    nvd.nist.gov

References