CVE-2022-39173 In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake.

What is CVE-2022-39173?

CVE-2022-39173 is a high-severity vulnerability in Wolfssl Wolfssl, published on 29 Sep 2022.

Official description

In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required to contain a list of duplicate cipher suites to trigger the buffer overflow. In total, two Client Hellos have to be sent: one in the resumed session, and a second one as a response to a Hello Retry Request message.

Weakness: CWE-787

Which versions are affected by CVE-2022-39173?

It affects 1 product.

Products include Wolfssl Wolfssl.

How do I fix CVE-2022-39173?

Upgrade to a fixed version.

Is CVE-2022-39173 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39173 exists.

Other vulnerabilities in Wolfssl Wolfssl

• CVE-2024-5991 Buffer overread in domain name matching Critical 10.0
• CVE-2021-37155 Security feature bypass in n/a Critical 9.8
• CVE-2020-36177 Memory corruption in n/a Critical 9.8
• CVE-2014-2896 Memory corruption in n/a Critical 9.8
• CVE-2014-2897 Memory corruption in n/a Critical 9.8

All Wolfssl Wolfssl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2022-39173, GHSA-ww6v-6x26-hgfc, JLSEC-2026-673, UBUNTU-CVE-2022-39173.