CVE-2026-7531 — Use-after-free in PQC hybrid key-share handling
Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 (released in 5.9.1): a malicious TLS 1.3 server sending a truncated PQC hyb…
Published: 2026-06-25 · CVSS: 2.3 · CVSS 4.0
Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 (released in 5.9.1): a malicious TLS 1.3 server sending a truncated PQC hybrid KeyShare can still trigger the error cleanup path to operate on freed memory.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7