Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
wolfSSL TLS 1.3 PQC KeyShare Processing Can Leak Sensitive Data
CVE-2026-5460
Summary
The wolfSSL TLS 1.3 implementation for post-quantum cryptography has a bug that allows sensitive data to be leaked. This is a security risk because it could potentially expose confidential information. To mitigate this, update to the latest version of wolfSSL.
Original title
A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptography (PQC) hybrid KeyShare processing. In the error handling path of TLSX_KeyShare_ProcessPqcHybridClient() in src/tls.c, the ...
Original description
A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptography (PQC) hybrid KeyShare processing. In the error handling path of TLSX_KeyShare_ProcessPqcHybridClient() in src/tls.c, the inner function TLSX_KeyShare_ProcessPqcClient_ex() frees a KyberKey object upon encountering an error. The caller then invokes TLSX_KeyShare_FreeAll(), which attempts to call ForceZero() on the already-freed KyberKey, resulting in writes of zero bytes over freed heap memory.
nvd CVSS4.0
6.3
Vulnerability type
CWE-416
Use After Free
Published: 10 Apr 2026 · Updated: 10 Apr 2026 · First seen: 10 Apr 2026