A critical out-of-bounds read vulnerability in the wolfSSL library allows unauthenticated remote attackers to cause a denial of service via a crafted ALPN protocol list.

The flaw is an out-of-bounds read (CWE-125) occurring during ALPN parsing when the library is compiled with ALPN enabled. This issue affects unauthenticated users and can be triggered if the software is built with compatibility features such as enable-apachehttpd, enable-nginx, or enable-curl.

Successful exploitation of this vulnerability results in a process crash, leading to a denial of service for any application relying on the affected wolfSSL library. Given the CVSS score of 7.5, this poses a significant risk to service availability, particularly for critical infrastructure or web-facing services that utilize the library for TLS/SSL termination.

Immediate Action: Upgrade the wolfSSL library to version 5.9.0 or later, or apply the patch provided in the upstream repository at commit 922d04b3568c6428a9fb905ddee3ef5a68db3108.

Proactive Monitoring: Monitor application logs for unexpected process crashes or segmentation faults that may indicate an exploitation attempt.

Compensating Controls: If upgrading is not immediately feasible, disable the ALPN feature in the wolfSSL build configuration if it is not required for application functionality.

Public Exploit Available: No (exploit_available: unknown)

Organizations should prioritize updating the wolfSSL library to the latest version to eliminate the risk of service disruption. While the vulnerability requires specific build configurations to be active, the potential for remote denial of service makes patching a high-priority task for all security and IT operations teams.