Various hardening fixes across sniffer, QUIC, PKCS#11, TLS and tooling#10788

Open

aidangarske wants to merge 22 commits into

wolfSSL:masterfrom

aidangarske:fenrir-tls-batch-2026-06

Commits on Jun 25, 2026

F-6279 - Pin membrowse-action to commit SHA and drop persisted creds in zephyr report workflow
aidangarske
committed
F-5246 - Check IPv6 extension header fits before dereference in sniffer
aidangarske
committed
F-6302 - Bound ServerHello session ID copy by remaining sniffer input
aidangarske
committed
F-5728 - Guard ServerHello extension header read and length underflow in sniffer
aidangarske
committed
F-4809 - Guard ClientHello extension header read and length underflow in sniffer
aidangarske
committed
F-5856 - Check QUIC early data length before narrowing to word32
aidangarske
committed
F-5245 - Reset QUIC record length when XREALLOC fails to grow buffer
aidangarske
committed
F-5760 - Only free standalone BIOs in ssl_set_bio to avoid chained free UAF
aidangarske
committed
F-5926 - Reject OCSP response missing nonce when forced nonce check enabled
aidangarske
committed
F-5247 - Guard pemApp_ReadFile reallocation size against word32 overflow
aidangarske
committed
F-5727 - Guard asn1App_ReadFile reallocation size against word32 overflow
aidangarske
committed
F-5927 - Validate and clamp PKCS11 RSA public key attribute lengths
aidangarske
committed
F-5928 - Validate and clamp PKCS11 ECC public key attribute length
aidangarske
committed
F-5929 - Validate and clamp PKCS11 certificate attribute length
aidangarske
committed
F-5858 - Grow decompress buffer geometrically to avoid quadratic copy DoS
aidangarske
committed
F-6300 - Abort TLS 1.2 client on unsolicited ServerHello extension
aidangarske
committed
F-4229 - Reject negative Size in Ada AES_Set_Cbc_Encrypt wrapper
aidangarske
committed
F-5757 - Reject negative Size in Ada AES_Set_Cbc_Decrypt wrapper
aidangarske
committed
F-5855 - Bounds-check cert length against bundle end in esp_crt_bundle init
aidangarske
committed
F-5728 - Widen ServerHello extension length check to avoid word16 truncation
aidangarske
committed
F-4809 - Widen ClientHello extension length check to avoid word16 truncation
aidangarske
committed
F-6300 - Revert TLS 1.2 unsolicited ServerHello extension abort; breaks heartbeat interop
aidangarske
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Various hardening fixes across sniffer, QUIC, PKCS#11, TLS and tooling#10788

Various hardening fixes across sniffer, QUIC, PKCS#11, TLS and tooling#10788
aidangarske wants to merge 22 commits into
wolfSSL:masterfrom
aidangarske:fenrir-tls-batch-2026-06

Commits on Jun 25, 2026

F-6279 - Pin membrowse-action to commit SHA and drop persisted creds in zephyr report workflow

F-5246 - Check IPv6 extension header fits before dereference in sniffer

F-6302 - Bound ServerHello session ID copy by remaining sniffer input

F-5728 - Guard ServerHello extension header read and length underflow in sniffer

F-4809 - Guard ClientHello extension header read and length underflow in sniffer

F-5856 - Check QUIC early data length before narrowing to word32

F-5245 - Reset QUIC record length when XREALLOC fails to grow buffer

F-5760 - Only free standalone BIOs in ssl_set_bio to avoid chained free UAF

F-5926 - Reject OCSP response missing nonce when forced nonce check enabled

F-5247 - Guard pemApp_ReadFile reallocation size against word32 overflow

F-5727 - Guard asn1App_ReadFile reallocation size against word32 overflow

F-5927 - Validate and clamp PKCS11 RSA public key attribute lengths

F-5928 - Validate and clamp PKCS11 ECC public key attribute length

F-5929 - Validate and clamp PKCS11 certificate attribute length

F-5858 - Grow decompress buffer geometrically to avoid quadratic copy DoS

F-6300 - Abort TLS 1.2 client on unsolicited ServerHello extension

F-4229 - Reject negative Size in Ada AES_Set_Cbc_Encrypt wrapper

F-5757 - Reject negative Size in Ada AES_Set_Cbc_Decrypt wrapper

F-5855 - Bounds-check cert length against bundle end in esp_crt_bundle init

F-5728 - Widen ServerHello extension length check to avoid word16 truncation

F-4809 - Widen ClientHello extension length check to avoid word16 truncation

F-6300 - Revert TLS 1.2 unsolicited ServerHello extension abort; breaks heartbeat interop