Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions
Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation.
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients.
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade opensslUpgrade openssl-perlUpgrade openssl-develUpgrade openssl-libs | Nov 21, 2024 | Apr 8, 2024 |
| Alpine Linux | — | Upgrade openssl | Jun 6, 2024 | Apr 8, 2024 |
| Amazon Linux Ami 2 | — | Upgrade openssl11-staticUpgrade openssl11-debuginfoUpgrade edk2-aarch64Upgrade edk2-tools-docUpgrade edk2-ovmfUpgrade openssl11-libsUpgrade openssl11-develUpgrade edk2-debuginfoUpgrade edk2-tools-pythonUpgrade edk2-toolsUpgrade openssl11 | May 16, 2024 | Apr 8, 2024 |
| Amazon_linux_2023 | — | Upgrade openssl-libs-debuginfoUpgrade openssl-libsUpgrade opensslUpgrade openssl-snapsafe-libs-debuginfoUpgrade openssl-perlUpgrade openssl-develUpgrade openssl-debuginfoUpgrade openssl-debugsourceUpgrade openssl-snapsafe-libs | Feb 17, 2025 | Apr 8, 2024 |
| Debian | — | Upgrade openssl | Sep 2, 2024 | Apr 8, 2024 |
| Dell Powerstore Dsa2024408 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 26, 2024 |
| Dell Powerstore Dsa2024432 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Oct 29, 2024 |
| F5 Big Ip | — | — | Nov 11, 2024 | Apr 8, 2024 |
| Freebsd | — | Upgrade openssl31Upgrade opensslUpgrade openssl-quictlsUpgrade openssl31-quictlsUpgrade openssl32 | Dec 10, 2025 | Apr 11, 2024 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Jun 5, 2024 | Apr 8, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade opensslUpgrade openssl-perlUpgrade openssl-libs | Jul 16, 2024 | Apr 8, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade opensslUpgrade openssl-perlUpgrade openssl-libs | Jun 26, 2024 | Apr 8, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade opensslUpgrade openssl-perlUpgrade openssl-libs | Oct 8, 2024 | Apr 8, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade openssl-perlUpgrade openssl-libsUpgrade openssl-develUpgrade openssl | Jul 23, 2024 | Apr 8, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade openssl-perlUpgrade opensslUpgrade openssl-libs | Jul 17, 2024 | Apr 8, 2024 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory41 | Jul 17, 2024 | Apr 8, 2024 |
| Oracle_linux | — | Upgrade openssl-develUpgrade opensslUpgrade openssl-fips-providerUpgrade openssl-fips-provider-soUpgrade openssl-libsUpgrade openssl-perl | Nov 21, 2024 | Apr 8, 2024 |
| Redhat_linux | — | Upgrade openssl-fips-provider-so-debuginfoUpgrade openssl-libsUpgrade openssl-develUpgrade openssl-perlUpgrade openssl-libs-debuginfoUpgrade openssl-debuginfoNo solution existsUpgrade openssl-fips-provider-soUpgrade opensslUpgrade openssl-fips-providerUpgrade openssl-fips-provider-so-debugsourceUpgrade openssl-debugsource | Nov 13, 2024 | Apr 8, 2024 |
| Rocky_linux | — | Upgrade openssl-perlUpgrade opensslUpgrade openssl-libs-debuginfoUpgrade openssl-libsUpgrade openssl-debuginfoUpgrade openssl-develUpgrade openssl-debugsource | Mar 18, 2025 | Apr 8, 2024 |
| Suse | — | Upgrade libopenssl-3-fips-providerUpgrade libopenssl-1_1-devel-32bitUpgrade openssl-3-docUpgrade libopenssl3-32bitUpgrade openssl-1_1Upgrade openssl-1_1-docUpgrade openssl-3Upgrade libopenssl1_1-hmac-32bitUpgrade libopenssl3-x86-64-v3Upgrade libopenssl1_1Upgrade libopenssl1_1-hmacUpgrade libopenssl-3-develUpgrade libopenssl-3-fips-provider-32bitUpgrade libopenssl-1_1-develUpgrade libopenssl-3-fips-provider-x86-64-v3Upgrade libopenssl3Upgrade libopenssl-3-devel-32bitUpgrade libopenssl1_1-32bit | May 15, 2024 | Apr 8, 2024 |
| Ubuntu | — | Upgrade libssl3t64Upgrade qemu-efi-armUpgrade libssl1.0.0 (Ubuntu Pro)Upgrade qemu-efi-loongarch64Upgrade qemu-efi-riscv64Upgrade qemu-efi-aarch64Upgrade libssl1.1Upgrade qemu-efiUpgrade openssl1.0 (Ubuntu Pro)Upgrade libssl1.1 (Ubuntu Pro)Upgrade ovmf-ia32Upgrade openssl (Ubuntu Pro)Upgrade ovmfUpgrade libssl3 | Aug 1, 2024 | Apr 8, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 8, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub