CVE-2026-103415

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A TLS 1.3 client fails to verify if a server-provided cookie fits within the outgoing packet when processing a HelloRetryRequest. Because the cookie length and content are controlled by the peer and the write operation occurs before certificate authentication, a malicious server can overwrite memory beyond the TLS packet buffer without providing a certificate. This issue specifically affects the client path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.