Skip to main content

CVE-2026-16317 and CVE-2026-16318: Issues with s2n-tls: an open-source implementation of the TLS/SSL protocols

Bulletin ID: 2026-062-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 07/21/2026 13:00 PM PDT

Description:

s2n-tls is an open source C99 implementation of the TLS/SSL protocol. We have identified two distinct issues:

  • CVE-2026-16317: Silent Drop of TLS 1.3 Encrypted Records in s2n-tls
    Missing validation of the outer content_type byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently drop individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer content_type of all encrypted TLS 1.3 records must be application_data (0x17). The s2n-tls AEAD implementation hardcodes this value in the additional authenticated data rather than using the actual wire byte, so the outer content_type is not covered by the authentication tag. All TLS 1.3 connections are affected. Both TLS clients and servers are affected. TLS 1.2 and QUIC connections are not affected.

  • CVE-2026-16318: QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls
    Incorrect use of s2n_alloc instead of s2n_realloc in the QUIC transport parameters extension handler in s2n-tls causes one memory allocation to be leaked each time a QUIC-enabled TLS 1.3 connection goes through a HelloRetryRequest. This can occur during normal handshakes when a client offers a key share group the server does not prefer, and can lead to increased memory consumption on long-running server processes. Only QUIC-enabled deployments are affected.

Impacted versions: <= v1.7.5

Resolution:

These issues have been addressed in s2n-tls version v1.7.6. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

For CVE-2026-16317 (Silent Drop of TLS 1.3 Encrypted Records), there is no workaround that fully mitigates this issue. Configuring s2n-tls to use only TLS 1.2 security policies would avoid the affected code path, but this is not recommended as it removes the security benefits of TLS 1.3.

For CVE-2026-16318 (QUIC Transport Parameters Memory Leak During HelloRetryRequest), deployments that do not enable QUIC are not affected and do not require any action. For QUIC-enabled deployments, restarting server processes periodically can reclaim the unreachable memory as a temporary mitigation.

References:


Please email aws-security@amazon.com with any security questions or concerns.: