CVE-2026-16318

A flaw was found in s2n-tls, a Transport Layer Security TLS implementation. An unauthenticated remote attacker can exploit a memory leak in the QUIC transport parameters extension handler. By repeatedly forcing HelloRetryRequests during a TLS 1.3 connection, an attacker can cause the server proce...

CVE-2026-16318

The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2nalloc instead of s2nrealloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2nalloc zeroes...

EUVD-2026-46402

The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2nalloc instead of s2nrealloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2nalloc zeroes...

CVE-2026-16318

The CVE-2026-16318 issue affects server-side QUIC deployments using s2n-tls, where the QUIC transport parameters extension handler uses s2n_alloc instead of s2n_realloc. During TLS 1.3 HelloRetryRequest, the handler runs twice on the same connection; on the second run it zeroes the existing point...

CVE-2026-16317

The flaw affects s2n-tls (TLS 1.3) where the outer content_type byte is not covered by the AEAD tag because it is hardcoded in AAD instead of using the wire byte. This allows an active MITM to silently discard individual application_data records without detection, enabling selective suppression o...

CVE-2026-16317 Silent Drop of TLS 1.3 Encrypted Records in s2n-tls

Missing validation of the outer contenttype byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer contenttype of all...

CVE-2026-16317 Silent Drop of TLS 1.3 Encrypted Records in s2n-tls

Missing validation of the outer contenttype byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer contenttype of all...

PT-2026-62072

The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2n alloc instead of s2n realloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2n alloc zero...

msgtrans (>=0.1.0 <=0.1.6), s2n-quic (>=1.18.0 <=1.37.0) +3 more potentially affected by unknown CVE via s2n-tls (>=0.0.10 <=0.3.1)

s2n-tls CARGO version =0.0.10, =0.1.0, =1.18.0, =0.18.2, =0.18.2, =0.0.6, =0.3.1 Source cves: unknown CVE Source advisory: OSV:GHSA-RP9H-RF7G-HWGR...

GHSA-RP9H-RF7G-HWGR s2n-tls has undefined behavior at process exit

Impact s2n-tls uses the Linux atexit function to register functions that clean up the global state when the process exits. In multi-threaded environments, the atexit handler may clean up state which is still in use by other threads. When this occurs, the exiting process may experience a...

s2n-tls has undefined behavior at process exit

Impact s2n-tls uses the Linux atexit function to register functions that clean up the global state when the process exits. In multi-threaded environments, the atexit handler may clean up state which is still in use by other threads. When this occurs, the exiting process may experience a...

msgtrans (>=0.1.0 <=0.1.6), s2n-quic (>=1.18.0 <=1.37.0) +3 more potentially affected by unknown CVE via s2n-tls (>=0.0.10 <=0.2.9)

s2n-tls CARGO version =0.0.10, =0.1.0, =1.18.0, =0.18.2, =0.18.2, =0.0.6, =0.2.11 Source cves: unknown CVE Source advisory: OSV:GHSA-857Q-XMPH-P2V5...

GHSA-857Q-XMPH-P2V5 s2n-tls's mTLS API ordering may skip client authentication

Impact An API ordering issue in s2n-tls can cause client authentication to unexpectedly not be enabled on the server when it otherwise appears to be. Server applications are impacted if client authentication is enabled by calling s2nconnectionsetconfig before calling s2nconnectionsetclientauthtyp...

s2n-tls's mTLS API ordering may skip client authentication

Impact An API ordering issue in s2n-tls can cause client authentication to unexpectedly not be enabled on the server when it otherwise appears to be. Server applications are impacted if client authentication is enabled by calling s2nconnectionsetconfig before calling s2nconnectionsetclientauthtyp...

s2n-tls has a potentially observable differences in RSA premaster secret handling

When receiving a message from a client that sent an invalid RSA premaster secret, an issue in s2n-tls results in the server performing additional processing when the premaster secret contains an incorrect client hello version. While no practical attack on s2n-tls has been demonstrated, this cause...