bash-tls-reneg-attack

bash-tls-reneg-attack opensslクライアントを使用してTLS再ネゴシエーションでサーバーをフラッディングしようとするbashスクリプト。詳細についてはCVE-2011-1473およびCVE-2011-1473を参照してください。 使用法: ./tls-reneg.sh some.hostname.here:port...

cve-2009-3555-test-server

これは何ですか？ これは、Go TLS スタックのベンダーフォークを使用した TLS サーバーで、ネゴシエーション再開拡張 renegotiation indication extension が強制的に無効化されており、OpenSSL 3.0+ の CVE-2009-3555 軽減策をトリガーします。Go TLS スタックはそもそも再ネゴシエーションを一切許可しないため、実際に CVE-2009-3555 に対して脆弱ではありません。...

russh: russh: Denial of Service via unbounded memory exhaustion during stalled key renegotiation

A flaw was found in russh. An authenticated remote attacker can cause a Denial of Service DoS by initiating a Secure Shell SSH key renegotiation without completing it and flooding the server with channel open requests. Because the server continues buffering incoming requests without draining the...

cve-2021-3449

CVE-2021-3449 OpenSSL この問題は 2021 年 3 月 17 日に Nokia から OpenSSL に報告されました。修正は Nokia の Peter Kästle と Samuel Sapalski によって開発されました。 対策 既知の修正方法は libssl1.1 を更新することのみです。 一部のアプリケーションはデフォルトで TLS 再ネゴシエーションを無効化する堅牢な TLS 設定を使用していますが、古い OpenSSL バージョンを実行している場合、このバグの影響を受けます。 エクスプロイト main.go は TLS...

CVE-2026-102821

A flaw was found in russh. An authenticated remote attacker can cause a Denial of Service DoS by initiating a Secure Shell SSH key renegotiation without completing it and flooding the server with channel open requests. Because the server continues buffering incoming requests without draining the...

PT-2026-97310

Name of the Vulnerable Software and Affected Versions Apache Tomcat Native versions 1.3.0 through 1.3.8 Apache Tomcat Native versions 2.0.0 through 2.0.15 Description Apache Tomcat Native enables several insecure OpenSSL options by default. These include ALLOW CLIENT RENEGOTIATION, NO EXTENDED...

Astra Linux – Vulnerability in freerdp3, freerdp2

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.22.0, the renegotiation of the AUDIN format freed the active format list, while the capture thread continued to use audin-format. This led to a use after free in audioformatcompatible. This vulnerability has been...

OpenVPN 2.6.0 < 2.6.21 / 2.7.x < 2.7.5 Multiple Vulnerabilities

According to its self-reported version number, the version of OpenVPN installed on the remote Windows host is affected by multiple vulnerabilities: - A use-after-free bug in ackwritebuf, triggerable by a well-timed sequence of control channel and authentication packets. CVE-2026-12996 - A...

CVE-2026-13117

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage...

JLSEC-2026-519

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a norenegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the...

PT-2026-47001

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutl...

freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation

A use after free flaw was found in FreeRDP. AUDIN format renegotiation frees the active format list while the capture thread continues using audin-format, leading to a use after free in audioformatcompatible. A malicious server can trigger a client‑side heap use after free causing a crash...

CLSA-2026-1778489013 spice: Fix of CVE-2021-20201

CVE-2021-20201: fix DoS via uncontrolled TLS renegotiation by disabling client-initiated renegotiation...

freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation

A use after free flaw was found in FreeRDP. AUDIN format renegotiation frees the active format list while the capture thread continues using audin-format, leading to a use after free in audioformatcompatible. A malicious server can trigger a client‑side heap use after free causing a crash...

JLSEC-2026-223 openssl-src NULL pointer Dereference in `signature_algorithms` processing

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signaturealgorithms extension where it was present in the initial ClientHello, but includes a signaturealgorithmscert extension then a NU...

freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation

A use after free flaw was found in FreeRDP. AUDIN format renegotiation frees the active format list while the capture thread continues using audin-format, leading to a use after free in audioformatcompatible. A malicious server can trigger a client‑side heap use after free causing a crash...

freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation

A use after free flaw was found in FreeRDP. AUDIN format renegotiation frees the active format list while the capture thread continues using audin-format, leading to a use after free in audioformatcompatible. A malicious server can trigger a client‑side heap use after free causing a crash...

freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation

A use after free flaw was found in FreeRDP. AUDIN format renegotiation frees the active format list while the capture thread continues using audin-format, leading to a use after free in audioformatcompatible. A malicious server can trigger a client‑side heap use after free causing a crash...

Important: Red Hat Security Advisory: freerdp security update

An update for freerdp is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation

A use after free flaw was found in FreeRDP. AUDIN format renegotiation frees the active format list while the capture thread continues using audin-format, leading to a use after free in audioformatcompatible. A malicious server can trigger a client‑side heap use after free causing a crash...