From f647f28a8eadd53d4898ea571182faa7683f0a9a Mon Sep 17 00:00:00 2001 From: Rahul Jain Date: Thu, 16 Apr 2026 21:05:23 +0530 Subject: [PATCH] Fix CVE-2026-35328: libtls supported_versions extension --- src/libtls/tls_server.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/src/libtls/tls_server.c b/src/libtls/tls_server.c index 1fd3955..bffc01c 100644 --- a/src/libtls/tls_server.c +++ b/src/libtls/tls_server.c @@ -471,15 +471,12 @@ static status_t process_client_hello(private_tls_server_t *this, bio_reader_t *client_versions; client_versions = bio_reader_create(versions); - while (client_versions->remaining(client_versions)) + while (client_versions->read_uint16(client_versions, &version)) { - if (client_versions->read_uint16(client_versions, &version)) + if (this->tls->set_version(this->tls, version, version)) { - if (this->tls->set_version(this->tls, version, version)) - { - this->client_version = version; - break; - } + this->client_version = version; + break; } } client_versions->destroy(client_versions); -- 2.50.0