CVE-2022-2906

Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only)

High · published September 21, 2022

CVSS v3.1
7.5
EPSS
2%
Percentile
81.2
In the wild
Unconfirmed
What it is

An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02065 · 81.2th percentile
Published
2022-09-21T10:15Z
EPSS history
Timeline
  • 21 SEP 10:15Z
    Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only)
    cvelistv5