CVE-2026-11703: wolfSSL TLS session resumption

CISO Take

A flaw in wolfSSL's TLS stack (CWE-287) allowed stateful, session-ID-based resumption to skip the SNI/ALPN binding check that ticket-based resumption already enforced, meaning a cached session negotiated for one virtual host could be resumed under a different hostname or protocol, potentially carrying over client-certificate authentication state into a context where it was never established. This matters for any multi-tenant AI infrastructure — inference gateways, edge AI appliances, or API front-ends — that terminates TLS with wolfSSL, uses SNI to route to multiple services, and applies differing client-auth requirements per host. Real-world exploitability is currently low: EPSS sits at 0.21% (top 89th percentile, i.e., most CVEs are more likely to be exploited than this one), there's no public exploit or Nuclei template, it's not in CISA KEV, and CISA's own SSVC decision is TRACK, not urgent action. Still, the failure mode (cross-virtual-host auth confusion) is high-value if it lands on the wrong deployment, so patch to the version containing the fix in wolfSSL PR #10489 and, until then, disable stateful session-ID resumption (session tickets alone already validate the binding) on any wolfSSL-terminated endpoint serving multiple hosts with different client-cert policies. Detection-wise, audit TLS proxy/gateway configs for shared wolfSSL contexts across SNI-differentiated virtual hosts with mixed mTLS requirements.

Sources: NVD EPSS CISA KEV wolfssl.com ATLAS

What is the risk?

Medium risk. The vulnerability requires a specific deployment pattern to be exploitable — SNI-based virtual hosting on a shared wolfSSL TLS context, differing client-certificate authentication policies per host, and stateful (session-ID) resumption enabled — which narrows real-world exposure considerably. EPSS (0.21%, 89th percentile) indicates low near-term exploitation likelihood, there is no public exploit code or scanner template, it is absent from CISA KEV, and CISA's SSVC decision is TRACK (monitor, not urgent remediation). However, where the vulnerable pattern does exist — e.g., multi-tenant AI API gateways or inference platforms serving several customers/models behind one TLS listener with tenant-specific client-auth policies — successful exploitation could allow authentication state from a stricter host to improperly authorize access to a less-trusted one, which is a meaningful confidentiality/integrity concern for tenant isolation.

How does the attack unfold?

Initial authenticated session

Attacker establishes a legitimate TLS session with client-certificate authentication against a strictly-authenticated virtual host on a shared wolfSSL gateway.

Cross-host session resumption

Attacker presents the cached session ID to resume the session under a different SNI/ALPN pointing to a virtual host with weaker client-auth requirements.

AML.T0049

Authentication state carryover

Vulnerable wolfSSL skips the SNI/ALPN binding check for stateful resumption, letting the original host's peer-authentication state apply in the new host's context.

Unauthorized access impact

Attacker gains access to a tenant's AI inference endpoint or data under an authentication context it was never granted for that virtual host.

Initial authenticated session

Attacker establishes a legitimate TLS session with client-certificate authentication against a strictly-authenticated virtual host on a shared wolfSSL gateway.

Cross-host session resumption

Attacker presents the cached session ID to resume the session under a different SNI/ALPN pointing to a virtual host with weaker client-auth requirements.

AML.T0049

Authentication state carryover

Vulnerable wolfSSL skips the SNI/ALPN binding check for stateful resumption, letting the original host's peer-authentication state apply in the new host's context.

Unauthorized access impact

Attacker gains access to a tenant's AI inference endpoint or data under an authentication context it was never granted for that virtual host.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
wolfSSL	—	—	No patch

Do you use wolfSSL? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.2%

chance of exploitation in 30 days

Higher than 11% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Upgrade wolfSSL to the release that incorporates the fix in PR #10489 (verify the exact fixed version against the wolfSSL security advisories page, as it was not specified in the available data). As an interim workaround, disable stateful session-ID resumption on any TLS listener that serves multiple virtual hosts (SNI) with differing client-certificate/mTLS policies — session-ticket-based resumption is unaffected since it already enforces the binding check. For detection, review TLS termination/gateway configurations for shared wolfSSL contexts spanning virtual hosts with inconsistent client-auth requirements, and monitor TLS proxy logs for session resumptions where the resumed SNI/ALPN differs from the session's original negotiation.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass API Inference AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.2 - AI system security controls

NIST AI RMF

MANAGE 2.3 - Mechanisms for regular review of AI system security

Frequently Asked Questions

What is CVE-2026-11703?

A flaw in wolfSSL's TLS stack (CWE-287) allowed stateful, session-ID-based resumption to skip the SNI/ALPN binding check that ticket-based resumption already enforced, meaning a cached session negotiated for one virtual host could be resumed under a different hostname or protocol, potentially carrying over client-certificate authentication state into a context where it was never established. This matters for any multi-tenant AI infrastructure — inference gateways, edge AI appliances, or API front-ends — that terminates TLS with wolfSSL, uses SNI to route to multiple services, and applies differing client-auth requirements per host. Real-world exploitability is currently low: EPSS sits at 0.21% (top 89th percentile, i.e., most CVEs are more likely to be exploited than this one), there's no public exploit or Nuclei template, it's not in CISA KEV, and CISA's own SSVC decision is TRACK, not urgent action. Still, the failure mode (cross-virtual-host auth confusion) is high-value if it lands on the wrong deployment, so patch to the version containing the fix in wolfSSL PR #10489 and, until then, disable stateful session-ID resumption (session tickets alone already validate the binding) on any wolfSSL-terminated endpoint serving multiple hosts with different client-cert policies. Detection-wise, audit TLS proxy/gateway configs for shared wolfSSL contexts across SNI-differentiated virtual hosts with mixed mTLS requirements.

Is CVE-2026-11703 actively exploited?

No confirmed active exploitation of CVE-2026-11703 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-11703?

Upgrade wolfSSL to the release that incorporates the fix in PR #10489 (verify the exact fixed version against the wolfSSL security advisories page, as it was not specified in the available data). As an interim workaround, disable stateful session-ID resumption on any TLS listener that serves multiple virtual hosts (SNI) with differing client-certificate/mTLS policies — session-ticket-based resumption is unaffected since it already enforces the binding check. For detection, review TLS termination/gateway configurations for shared wolfSSL contexts spanning virtual hosts with inconsistent client-auth requirements, and monitor TLS proxy logs for session resumptions where the resumed SNI/ALPN differs from the session's original negotiation.

What systems are affected by CVE-2026-11703?

This vulnerability affects the following AI/ML architecture patterns: model serving, API gateways / multi-tenant inference platforms, edge/embedded AI deployments.

What is the CVSS score for CVE-2026-11703?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

model servingAPI gateways / multi-tenant inference platformsedge/embedded AI deployments

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.2

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual hosts, carry the cached peer-authentication state into a context it was not established for. Resumption now verifies the SNI/ALPN binding for all paths and declines (falling back to a full handshake) on mismatch.

Exploitation Scenario

An attacker first establishes a legitimate TLS session — including client-certificate authentication — against a strictly-authenticated virtual host (Host A) on a shared wolfSSL-based gateway fronting several AI services (e.g., different model-serving tenants routed by SNI). The client then presents the cached session ID while connecting to a different virtual host (Host B) on the same listener, one with weaker or no client-certificate requirements. Prior to the fix, wolfSSL would resume the session without re-validating that the SNI/ALPN matched the original negotiation, potentially allowing Host A's authenticated peer state to be treated as valid in Host B's context — giving the attacker access to a tenant's inference endpoint or data they were never authorized for under Host B's own policy.

Weaknesses (CWE)

CWE-287 Improper Authentication

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.