CVE-2022-39368

CVE-2022-39368 affects Eclipse Californium (Java CoAP) versions prior to 3.7.0 and 2.7.4. The root cause is that failing DTLS handshakes do not clean up throttling counters, allowing the threshold to be reached and never released, which can lead to a denial of service by permanently dropping reco...

CVE-2022-2576

In Eclipse Californium, CVE-2022-2576 affects versions 2.0.0–2.7.2 and 3.0.0–3.5.0. The DTLS resumption handshake can fall back to a full DTLS handshake on parameter mismatch without a HelloVerifyRequest, which, when used with certificate-based cipher suites, enables message amplification that ca...

CVE-2020-27222

CVE-2020-27222 affects the Eclipse Californium DTLS implementation. Versions 2.3.0 through 2.6.0 experience a certificate-based DTLS handshake failure caused by the server persisting a wrong internal state after a prior handshake failure with TLS parameter mismatch. This state corruption allows a...

CVE-2021-34433

The CVE concerns Eclipse Californium where certificate-based DTLS handshakes (X.509 and RPK) can accidentally succeed without verifying the client-side signature on the server, if the signature is not included in the server’s ServerKeyExchange. Affected versions are 2.0.0–2.6.4 and 3.0.0-M1–3.0.0...