CVE-2026-5066: TLS Session Cache Out-of-Bounds Write Vulnerability

Technical summary

CVE-2026-5066 is an out-of-bounds write/read vulnerability in subsys/net/lib/sockets/sockets_tls.c affecting the TLS session cache mechanism. The vulnerability occurs in tls_session_store() and tls_session_restore() functions where memcpy operations copy caller-supplied socket addresses into a fixed-size buffer using an unchecked, caller-controlled addrlen parameter. Since struct net_sockaddr is opaque, applications can provide an addrlen value exceeding sizeof(struct net_sockaddr)—for instance, 128 bytes into a 24-byte stack buffer—resulting in out-of-bounds memory read and write operations. This memory corruption affects the TLS session cache memory region and adjacent stack data.

Business impact

Exploitation requires authenticated network access and TLS session caching to be enabled, reducing the immediate attack surface. However, when conditions are met, the vulnerability enables denial of service through crashes and potential remote code execution within the affected process. Systems hosting network services that authenticate clients and cache TLS sessions face elevated risk. The impact scales with service criticality and network exposure.

Affected systems

The vulnerability resides in the network sockets subsystem and specifically targets deployments where TLS session caching is enabled in production configurations. No specific vendor products have been pre-identified in the vulnerability record; identification requires review of affected software that integrates this network sockets library and enables TLS session caching functionality.

Exploitability

Exploitation requires authenticated network access (PR:L in the CVSS vector), meaning an attacker must first establish legitimate credentials or pass local authentication. The attack does not require user interaction. The technical barrier is moderate—an attacker must craft a malicious address structure with an inflated addrlen value and trigger a TLS session cache operation. No known public exploits are documented, and the vulnerability is not tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Vendors should implement strict validation of addrlen against the actual size of struct net_sockaddr before performing memcpy operations in both tls_session_store() and tls_session_restore(). Input validation must occur regardless of whether the application supplies the addrlen value. Organizations should monitor vendor advisories for patched versions and test patches in non-production environments before deployment.

Patch guidance

Consult the software vendor's security advisory for specific patched version numbers and deployment instructions. Patches should address the memcpy bounds-checking issue in the TLS session cache code path. When available, apply patches to systems with TLS session caching enabled. Prioritize systems that accept authenticated network connections and rely on TLS session persistence.

Detection guidance

Monitor system logs and crash reports for unexpected process terminations associated with network socket operations, particularly those handling TLS connections with session caching active. Kernel or application-level memory protection features (stack canaries, Address Sanitizer) may detect out-of-bounds accesses during development testing. Network-based detection is limited; focus detection efforts on host-level anomaly monitoring for crashes or unexpected process behavior following TLS handshakes.

Why prioritize this

CVSS 6.3 (Medium) reflects the requirement for authenticated network access and the dual risk of denial of service and code execution. Prioritize patching for internet-facing services that accept client authentication and maintain TLS session caches. Lower priority for internal-only services or deployments where TLS session caching is disabled.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) results from: Network attack vector (AV:N) reflecting remote exploitability, Low complexity (AC:L) as no special conditions are required post-authentication, Low privilege requirement (PR:L) mandating authentication, No user interaction (UI:N), and Unchanged scope (S:U). The confidentiality, integrity, and availability impacts (C:L, I:L, A:L) are each rated Low due to the memory corruption being confined to the TLS session cache region and adjacent stack memory, typically within a single process context.

Frequently asked questions