| Package | Affected versions | Patched versions |
|---|---|---|
| wolfssl | ≤ 5.9.0 |
When restoring a session from cache, a pointer from the serialized session data is used in a free operation without validation. An attacker who can poison the session cache could trigger an arbitrary free. Exploitation requires the ability to inject a crafted session into the cache and for the application to call specific session restore APIs.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free