Fenrir 2026-06-02: TLS/DTLS correctness, resumption & renegotiation safety fixes#10582

Open

julek-wolfssl wants to merge 10 commits into

wolfSSL:masterfrom

julek-wolfssl:fenrir-20260602

Commits on Jun 4, 2026

F-3888: add negative tests for tampered RSA signatures/hashes
julek-wolfssl
committed
F-4867: reject trailing bytes in TLS 1.3 EncryptedExtensions
julek-wolfssl
committed
F-4868: reject trailing bytes in TLS 1.3 CertificateRequest
julek-wolfssl
committed
F-5633: zeroize DTLS 1.3 ChaCha record-number keys before free
julek-wolfssl
committed
F-5807: enforce EMS consistency on client session resumption
julek-wolfssl
committed
F-5811: verify resumed cipher suite matches cached session
julek-wolfssl
committed
F-5813: fail TLS 1.2 record send before the sequence number wraps
julek-wolfssl
committed
F-5818: invalidate cached session on fatal alert
julek-wolfssl
committed

Commits on Jun 5, 2026