CVE-2022-38152

An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSL_clear is called on its session, the server crashes with a segmentation fault. This occurs in the second session, which is created through TLS session resumption and reuses the initial struct WOLFSSL. If the server reuses the previous session structure (struct WOLFSSL) by calling wolfSSL_clear(WOLFSSL* ssl) on it, the next received Client Hello (that resumes the previous session) crashes the server. Note that this bug is only triggered when resuming sessions using TLS session resumption. Only servers that use wolfSSL_clear instead of the recommended SSL_free; SSL_new sequence are affected. Furthermore, wolfSSL_clear is part of wolfSSL's compatibility layer and is not enabled by default. It is not part of wolfSSL's native API.

• CWE-754

• http://packetstormsecurity.com/files/170604/wolfSSL-Session-Resumption-Denial-Of-Service.htmlExploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2023/Jan/7Exploit, Mailing List, Third Party Advisory
• https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh/Third Party Advisory
• https://github.com/tlspuffin/tlspuffinNot Applicable
• https://github.com/wolfSSL/wolfssl/pull/5468Exploit, Patch, Third Party Advisory
• https://github.com/wolfSSL/wolfssl/releasesRelease Notes
• https://www.wolfssl.com/docs/security-vulnerabilities/Vendor Advisory
• http://packetstormsecurity.com/files/170604/wolfSSL-Session-Resumption-Denial-Of-Service.htmlExploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2023/Jan/7Exploit, Mailing List, Third Party Advisory
• https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh/Third Party Advisory
• https://github.com/tlspuffin/tlspuffinNot Applicable
• https://github.com/wolfSSL/wolfssl/pull/5468Exploit, Patch, Third Party Advisory
• https://github.com/wolfSSL/wolfssl/releasesRelease Notes
• https://www.wolfssl.com/docs/security-vulnerabilities/Vendor Advisory

Published

Aug 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-38146Silverstripe silverstripe/framework through 4.11 allows XSS …5.4
• CVE-2022-38147Silverstripe silverstripe/framework through 4.11 allows XSS …5.4
• CVE-2022-38148Silverstripe silverstripe/framework through 4.11 allows SQL …8.8
• CVE-2022-38149HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 m…7.5
• CVE-2022-3815A vulnerability, which was classified as problematic, has be…6.5
• CVE-2022-38150In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possi…7.5
• CVE-2022-38153An issue was discovered in wolfSSL before 5.5.0 (when --enab…5.9
• CVE-2022-38155TEE_Malloc in Samsung mTower through 0.3.0 allows a trusted …7.5
• CVE-2022-38156A remote command injection issues exists in the web server o…7.2
• CVE-2022-3816A vulnerability, which was classified as problematic, was fo…6.5
• CVE-2022-38161The Gumstix Overo SBC on the VSKS board through 2022-08-09, …7.5
• CVE-2022-38162Reflected cross-site scripting (XSS) vulnerabilities in With…6.1