wolfSSL Out-of-Bounds Read Vulnerability in ALPN Parsing Allowing Denial-of-Service

A vulnerability exists in wolfSSL versions through 5.8.4 in the ALPN (Application-Layer Protocol Negotiation) handling. When ALPN is enabled, incomplete validation can lead to an out-of-bounds read, potentially causing a process crash and resulting in a denial-of-service condition. Although ALPN is disabled by default, it is activated for certain third-party compatibility features, including Apache HTTPD, BIND, cURL, HAProxy, Hitch, Lighttpd, JNI, NGINX, and QUIC.

Impact

Exploitation of this vulnerability can cause a process crash, leading to a denial-of-service condition.