A new remote buffer overflow vulnerability was discovered in the latest version of the SharkSSL library from 05.05.2024 (https://github.com/RealTimeLogic/SharkSSL) by security evaluators of Deutsche Telekom Security GmbH and Deutsche Telekom AG with modern fuzzing methods. The vulnerability allows an attacker to read large regions of the SharkSSL TLS server’s memory. This is likely to result in a segmentation fault and can be used for a remote Denial-of-Service attack by an attacker. Special thanks to Robert Hörr for his support, supervision and guidance during this research.

View the full advisory