AIKIDO-2026-877705
openssl is vulnerable to Denial of Service (DoS)
37
Low Risk
This Affects:
opensslTL;DR
While a DTLS handshake is in progress, OpenSSL buffers a record that claims to belong to the next epoch by retaining the whole read buffer, about 16 kilobytes, instead of the record bytes. A peer can send many small records of that kind, up to the cap of 100 per connection, and force the endpoint to hold far more memory than the bytes on the wire, which can exhaust a DTLS server that accepts many associations. The fix stores only the record bytes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application uses DTLS.
Background info
openssl is vulnerable to Denial of Service (DoS) in versions 1.0.2 - 3.0.21, 3.4.0 - 3.4.6, 3.5.0 - 3.5.7, 3.6.0 - 3.6.3 and 4.0.0 - 4.0.1.
How to fix this
Upgrade the openssl library to the patch version.
Links
GitHub Release
Fix Commits
github.com/openssl/openssl/commit/4808b5d64176451f3d93d87d0ac9c81a9b13fb23github.com/openssl/openssl/commit/7110cb2f75806d0bf809eb2f90790d477900be40github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382github.com/openssl/openssl/commit/cc0c6710917cd5eec001b297355d2ba723505107github.com/openssl/openssl/commit/f52ffc11b90737ac89083909618dc2e1f42c561c
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.