mbedtls/ChangeLog.d/serialized-data-load-hardening.txt
Naveed b6d607d310 Reject out-of-bounds session ID length in ssl_tls12_session_load
Signed-off-by: Naveed <naveed@bugqore.com>
2026-08-03 13:45:52 +05:30

5 lines
211 B
Plaintext

Bugfix
* Reject serialized TLS 1.2 sessions whose session ID length exceeds 32,
instead of accepting an out-of-range length that is later used to read
past the end of the 32-byte session ID buffer.