The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2n_alloc instead of s2n_realloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRe…
Summary
The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2n_alloc instead of s2n_realloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2n_alloc zeroes the existing pointer before allocating new memory, causing the first allocation to be leaked. This can occur during normal QUIC traffic when a client offers a key share group the server does not p…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Lint boundary warnings (1)
The following non-blocking warnings were raised during the lint phase of this triage (e.g. reference URLs not yet on the allowlist). They do not affect entry usability and are disclosed for transparency (see DR-002).
-
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://staging.prod.website.marketing.aws.dev/security/security-bulletins/2026-062-aws/
Sources
- NVD DATABASE
Original Links
- https://github.com/aws/s2n-tls/releases/tag/v1.7.6
- https://github.com/aws/s2n-tls/security/advisories/GHSA-cr7x-863j-xrc7
- https://staging.prod.website.marketing.aws.dev/security/security-bulletins/2026-062-aws/
Timeline
- nvd_ingest NVD