Excessive Memory Use Buffering DTLS Records for a Future Epoch

Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large...

Asymmetric Resource Consumption (Amplification)

Overview league/commonmark is a PHP-based Markdown parser which supports the full CommonMark spec. It is based on the CommonMark JS reference implementation. Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification via the XmlRenderer process. An attacker...

Asymmetric Resource Consumption (Amplification)

Overview ws is a simple to use websocket client, server and console for node.js. Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification when handling a large number of very small fragments and data chunks. An attacker can cause excessive memory allocatio...

CVE-2024-41996

The Diffie-Hellman Key Agreement Protocol (DHE) implementation in several products is vulnerable to an issue where validating the order of public keys using an approved safe prime allows remote attackers to trigger unnecessarily expensive server-side modular-exponentiation calculations . This can...