Skip to main content

New research: Apex vs Claude Code Security vs Codex Security on the same codebase.

Vulnerability disclosure

ECH server-name handling writes beyond allocated memory

CVE-2026-5503

Affected product
wolfSSL
Severity
Critical
CVSS
9.1
Weakness
CWE-787
Published

Disclosure summary

CVE-2026-5503 is a critical-severity CWE-787 vulnerability in wolfSSL. ECH server-name handling writes beyond allocated memory. Cantina reproduced the behavior, verified its security impact, and coordinated disclosure with the affected maintainer.

Verification standard

Cantina publishes a disclosure only after reproducing the behavior, validating its security impact, and coordinating remediation with the affected project.