Excessive Memory Use Buffering DTLS Records for a Future Epoch

Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large...

Asymmetric Resource Consumption (Amplification)

Overview ws is a simple to use websocket client, server and console for node.js. Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification when handling a large number of very small fragments and data chunks. An attacker can cause excessive memory allocatio...

CVE-2024-41996

CVE-2024-41996 is cited in the Ubuntu USN/NASL doc as a vulnerability where validating the order of public keys in Diffie-Hellman with an approved safe prime can cause a client to trigger expensive server-side DHE exponentiations, leading to asymmetric resource consumption. The connected document...