CVE-2016-2179

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which…

published September 16, 2016

CVSS
—
EPSS
27%
Percentile
98.0
In the wild
Unconfirmed
What it is

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.26559 · 98.0th percentile
Published
2016-09-16T00:00Z
EPSS history
Timeline
  • 16 SEP 00:00Z
    The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which…
    cvelistv5