CVE-2020-25648CWE-770

A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3

published October 20, 2020

CVSS
—
EPSS
4%
Percentile
90.2
In the wild
Unconfirmed
What it is

A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03901 · 90.2th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2020-10-20T00:00Z
EPSS history
Timeline
  • 20 OCT 00:00Z
    A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3
    cvelistv5