CVE-2024-5991 Buffer overread in domain name matching
An attacker can cause a buffer overread in wolfSSL's domain name matching, potentially leading to crashes or information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-5991?
CVE-2024-5991 is a critical memory corruption vulnerability in Wolfssl Wolfssl, published on 27 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509_check_host() takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do a name check on a non-NULL terminated buffer, the code would read beyond the bounds of the input array until it found a NULL terminator.This issue affects wolfSSL: through 5.7.0.
Weakness: CWE-125
Which versions are affected by CVE-2024-5991?
It affects 1 product.
Products include Wolfssl Wolfssl.
How do I fix CVE-2024-5991?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-5991 being exploited?
There is no known exploitation of CVE-2024-5991 in the wild and no public exploit code.
Other vulnerabilities in Wolfssl Wolfssl
Sources
Also known as AZL-48342, AZL-48368, DEBIAN-CVE-2024-5991, GHSA-jwjf-h4v6-qrpp, JLSEC-2026-685, UBUNTU-CVE-2024-5991.