CVE-2026-16317

Name of the Vulnerable Software and Affected Versions s2n-tls versions prior to v1.7.6

Description Missing validation of the outer content type byte on TLS 1.3 encrypted records allows an active man-in-the-middle to silently discard individual application data records without detection by either endpoint. The s2n-tls AEAD (Authenticated Encryption with Associated Data) implementation hardcodes the content type value in the additional authenticated data instead of using the actual wire byte, leaving the outer content type uncovered by the authentication tag. This allows for selective suppression of application data. In HTTP pipelining scenarios, dropping a TLS record containing an HTTP request can lead to request/response desynchronization. In write-heavy workloads, a dropped record containing a write request can result in undetectable data loss if the client interprets a subsequent success response as confirmation of the dropped write.

Recommendations Upgrade to version v1.7.6.