mbedtls/ChangeLog.d/serialized-data-load-hardening.txt
Naveed c099994dca Reject out-of-bounds session ID length in ssl_tls12_session_load
Signed-off-by: Naveed <naveed@bugqore.com>
2026-07-09 13:07:44 +05:30

5 lines
211 B
Plaintext

Bugfix
* Reject serialized TLS 1.2 sessions whose session ID length exceeds 32,
instead of accepting an out-of-range length that is later used to read
past the end of the 32-byte session ID buffer.