CVE-2026-16317 and CVE-2026-16318: Issues with s2n-tls: an open-source implementation of the TLS/SSL protocols
Bulletin ID: 2026-062-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/21/2026 13:15 PM PDT Description: s2n-tls is an open source C99 implementation of the TLS/SSL protocol. We have identified two distinct issues: - CVE-2026-16317: Silent Drop of TLS 1.3 Encrypted Records in s2n-tls Missing validation of the outer content_type byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently drop individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer content_type of all encrypted TLS 1.3 records must be application_data (0x17). The s2n-tls AEAD implementation hardcodes this value in the additional authenticated data rather than using the actual wire byte, so the outer content_type is not covered by the authentication tag. All TLS 1.3 connections are affected. Both TLS clients and servers are affected. TLS 1.2 and QUIC connections are not affected. - CVE-2026-16318: QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls Incorrect use of s2n_alloc instead of s2n_realloc in the QUIC transport parameters extension handler in s2n-tls causes one memory allocation to be leaked each time a QUIC-enabled TLS 1.3 connection goes through a HelloRetryRequest. This can occur during normal handshakes when a client offers a key share group the server does not prefer, and can lead to increased memory consumption on long-running server processes. Only QUIC-enabled deployments are affected. Impacted versions: <= v1.7.5 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
AI Analysis
Technical Summary
The bulletin describes two distinct vulnerabilities in s2n-tls. CVE-2026-16317 concerns TLS 1.3 encrypted records where the implementation does not validate the outer content_type byte, which must be application_data (0x17) per RFC 8446. The AEAD implementation hardcodes this value in the authentication data rather than using the actual wire byte, allowing an active man-in-the-middle to silently drop application data records without detection by either endpoint. This affects all TLS 1.3 clients and servers using s2n-tls. CVE-2026-16318 is a memory leak in the QUIC transport parameters extension handler during HelloRetryRequest caused by using s2n_alloc instead of s2n_realloc, leaking one memory allocation per such handshake. This affects only QUIC-enabled deployments. Both vulnerabilities affect s2n-tls versions up to 1.7.5 and are resolved in version 1.7.6.
Potential Impact
CVE-2026-16317 allows an active man-in-the-middle attacker to silently drop individual TLS 1.3 application data records without detection, potentially disrupting communication without alerting endpoints. CVE-2026-16318 causes memory leaks in QUIC-enabled TLS 1.3 connections during HelloRetryRequest, which can lead to increased memory consumption and potential resource exhaustion on long-running servers. TLS 1.2 and non-QUIC deployments are not affected by these issues.
Mitigation Recommendations
Upgrade s2n-tls to version 1.7.6 or later, which addresses both vulnerabilities. For CVE-2026-16317, no full workaround exists; downgrading to TLS 1.2 avoids the issue but is not recommended due to loss of TLS 1.3 security benefits. For CVE-2026-16318, if QUIC is enabled and upgrading is not immediately possible, periodically restarting server processes can reclaim leaked memory as a temporary mitigation. Deployments not using QUIC are not affected by the memory leak.
CVE-2026-16317 and CVE-2026-16318: Issues with s2n-tls: an open-source implementation of the TLS/SSL protocols
Description
Bulletin ID: 2026-062-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/21/2026 13:15 PM PDT Description: s2n-tls is an open source C99 implementation of the TLS/SSL protocol. We have identified two distinct issues: - CVE-2026-16317: Silent Drop of TLS 1.3 Encrypted Records in s2n-tls Missing validation of the outer content_type byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently drop individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer content_type of all encrypted TLS 1.3 records must be application_data (0x17). The s2n-tls AEAD implementation hardcodes this value in the additional authenticated data rather than using the actual wire byte, so the outer content_type is not covered by the authentication tag. All TLS 1.3 connections are affected. Both TLS clients and servers are affected. TLS 1.2 and QUIC connections are not affected. - CVE-2026-16318: QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls Incorrect use of s2n_alloc instead of s2n_realloc in the QUIC transport parameters extension handler in s2n-tls causes one memory allocation to be leaked each time a QUIC-enabled TLS 1.3 connection goes through a HelloRetryRequest. This can occur during normal handshakes when a client offers a key share group the server does not prefer, and can lead to increased memory consumption on long-running server processes. Only QUIC-enabled deployments are affected. Impacted versions: <= v1.7.5 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The bulletin describes two distinct vulnerabilities in s2n-tls. CVE-2026-16317 concerns TLS 1.3 encrypted records where the implementation does not validate the outer content_type byte, which must be application_data (0x17) per RFC 8446. The AEAD implementation hardcodes this value in the authentication data rather than using the actual wire byte, allowing an active man-in-the-middle to silently drop application data records without detection by either endpoint. This affects all TLS 1.3 clients and servers using s2n-tls. CVE-2026-16318 is a memory leak in the QUIC transport parameters extension handler during HelloRetryRequest caused by using s2n_alloc instead of s2n_realloc, leaking one memory allocation per such handshake. This affects only QUIC-enabled deployments. Both vulnerabilities affect s2n-tls versions up to 1.7.5 and are resolved in version 1.7.6.
Potential Impact
CVE-2026-16317 allows an active man-in-the-middle attacker to silently drop individual TLS 1.3 application data records without detection, potentially disrupting communication without alerting endpoints. CVE-2026-16318 causes memory leaks in QUIC-enabled TLS 1.3 connections during HelloRetryRequest, which can lead to increased memory consumption and potential resource exhaustion on long-running servers. TLS 1.2 and non-QUIC deployments are not affected by these issues.
Mitigation Recommendations
Upgrade s2n-tls to version 1.7.6 or later, which addresses both vulnerabilities. For CVE-2026-16317, no full workaround exists; downgrading to TLS 1.2 avoids the issue but is not recommended due to loss of TLS 1.3 security benefits. For CVE-2026-16318, if QUIC is enabled and upgrading is not immediately possible, periodically restarting server processes can reclaim leaked memory as a temporary mitigation. Deployments not using QUIC are not affected by the memory leak.
Technical Details
- Article Source
- {"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-062-aws/","fetched":true,"fetchedAt":"2026-07-21T20:27:43.693Z","wordCount":378}
- Classification
- {"confidence":0.69,"severitySource":"default","classifier":"rss-v2"}
Threat ID: 6a5fd63f1010f89cc2274ba4
Added to database: 07/21/2026, 20:27:43 UTC
Last enriched: 08/15/2026, 18:31:46 UTC
Last updated: 09/03/2026, 10:52:07 UTC
Views: 141
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.