CVE-2026-3549 is a heap overflow in the TLS 1.3 Encrypted Client Hello parsing of wolfSSL, scored 9.8 (Critical) in the CVE record. An integer underflow in a length calculation writes past a buffer. wolfSSL notes that ECH is off by default.
What's affected
- Product: wolfSSL
- Affected builds: those with the ECH feature enabled
- Fix: pull request 9817 on the wolfSSL repository, merged on 26 February 2026
- Fixed release: not named in the record or the pull request page I read. Check the wolfSSL release notes
The pull request adds a guard so the inner client hello length cannot underflow during ECH parsing. The same pull request also touches DTLS import, NPN parsing and CRL handling, so it is a broader hardening change. The record is not clear about which exact releases are affected, and the CVE is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Check the wolfSSL version and the options your build used. For an autoconf build, the installed header shows both:
grep LIBWOLFSSL_VERSION_STRING /usr/local/include/wolfssl/version.h
grep -E "HAVE_CRL|HAVE_ECH" /usr/local/include/wolfssl/options.h
Paths differ by install. Many products embed wolfSSL, so also ask your vendors whether their firmware or application bundles it, and which version.
The record says ECH is off by default and that the ECH standard is still evolving. If your build does not define HAVE_ECH, this flaw does not apply to it.
What to do now
- Inventory your wolfSSL builds and applications that embed it.
- Check whether ECH is enabled. If you do not need it, leave it off.
- Upgrade to a wolfSSL release that contains pull request 9817. Confirm the release in the wolfSSL release notes.
- For vendor products, ask for an update and note the date you asked.
- Keep ECH disabled in production until you have a patched build.
Why it matters
An integer underflow happens when a subtraction goes below zero in an unsigned value and wraps to a very large number. That number was then used as a buffer length, so the code wrote beyond the buffer. The record files this under CWE-122, heap-based buffer overflow.
The parsing code runs during the TLS handshake, before any trust is established, which is why the vector shows a network attack with no privileges. The feature flag is the main brake. Features that are off by default and still being standardised should stay off until you need them.
Quick check
Is ECH on by default in wolfSSL?
No. The record says ECH is off by default.
Which version fixes this?
The record does not name one. The fix is in pull request 9817, so check the wolfSSL release notes for the first release that contains it.
Sources
Last reviewed: 19 October 2026.
