1. Home
  2. Vulnerabilities
  3. CVE-2024-2511
5.9
MEDIUM CVSS 3.1
CVE-2024-2511
Unbounded memory growth with session handling in TLSv1.3
Overview
Description

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.

Details
INFO

Published Date :

April 8, 2024, 2:15 p.m.

Last Modified :

Nov. 6, 2026, 7:29 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]
Impact
Affected Products

The following products are affected by CVE-2024-2511 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Siemens sinec_ins
2 Siemens simatic_s7-1500_cpu_1518-4_pn\/dp_firmware
3 Siemens scalance_m804pb_firmware
4 Siemens scalance_m874-2_firmware
5 Siemens scalance_m874-3_firmware
6 Siemens scalance_m876-3_firmware
7 Siemens scalance_m876-4_firmware
8 Siemens ruggedcom_rm1224_lte\(4g\)_eu_firmware
9 Siemens ruggedcom_rm1224_lte\(4g\)_nam_firmware
10 Siemens scalance_m812-1_adsl-router_firmware
11 Siemens scalance_m816-1_adsl-router_firmware
12 Siemens scalance_m826-2_shdsl-router_firmware
13 Siemens scalance_wam763-1_firmware
14 Siemens scalance_wam766-1_firmware
15 Siemens scalance_wum763-1_firmware
16 Siemens scalance_wum766-1_firmware
17 Siemens scalance_m804pb
18 Siemens scalance_m874-2
19 Siemens scalance_m874-3
20 Siemens scalance_m876-3
21 Siemens scalance_m876-4
22 Siemens simatic_s7-1500_cpu_1518-4_pn\/dp_mfp
23 Siemens ruggedcom_rm1224_lte\(4g\)_eu
24 Siemens ruggedcom_rm1224_lte\(4g\)_nam
25 Siemens scalance_m812-1_adsl-router
26 Siemens scalance_m816-1_adsl-router
27 Siemens scalance_m826-2_shdsl-router
28 Siemens scalance_wam763-1
29 Siemens scalance_wam766-1
30 Siemens scalance_wum763-1
31 Siemens scalance_wum766-1
32 Siemens scalance_m874-3_3g-router_\(cn\)_firmware
33 Siemens scalance_m874-3_3g-router_\(cn\)
34 Siemens scalance_m876-3_\(rok\)_firmware
35 Siemens scalance_m876-3_\(rok\)
36 Siemens scalance_m876-4_\(eu\)_firmware
37 Siemens scalance_m876-4_\(eu\)
38 Siemens scalance_m876-4_\(nam\)_firmware
39 Siemens scalance_m876-4_\(nam\)
40 Siemens scalance_mum853-1_\(a1\)_firmware
41 Siemens scalance_mum853-1_\(a1\)
42 Siemens scalance_mum853-1_\(b1\)_firmware
43 Siemens scalance_mum853-1_\(b1\)
44 Siemens scalance_mum853-1_\(eu\)_firmware
45 Siemens scalance_mum853-1_\(eu\)
46 Siemens scalance_mum856-1_\(a1\)_firmware
47 Siemens scalance_mum856-1_\(a1\)
48 Siemens scalance_mum856-1_\(b1\)_firmware
49 Siemens scalance_mum856-1_\(b1\)
50 Siemens scalance_mum856-1_\(cn\)_firmware
51 Siemens scalance_mum856-1_\(cn\)
52 Siemens scalance_mum856-1_\(eu\)_firmware
53 Siemens scalance_mum856-1_\(eu\)
54 Siemens scalance_mum856-1_\(row\)_firmware
55 Siemens scalance_mum856-1_\(row\)
56 Siemens scalance_s615_eec_lan-router_firmware
57 Siemens scalance_s615_eec_lan-router
58 Siemens scalance_s615_lan-router_firmware
59 Siemens scalance_s615_lan-router
60 Siemens ruggedcom_rst2428p
61 Siemens simatic_s7-1500_tm_mfp_firmware
62 Siemens simatic_s7-1500_tm_mfp
63 Siemens sinec_os
64 Siemens scalance_xcm324
65 Siemens scalance_xcm328
66 Siemens scalance_xcm332
67 Siemens scalance_xrh334
68 Siemens scalance_xrm334
69 Siemens scalance_xcm323
70 Siemens scalance_wab762-1_firmware
71 Siemens scalance_wab762-1
72 Siemens scalance_wub762-1_firmware
73 Siemens scalance_wub762-1
74 Siemens scalance_wub762-1_ifeatures_firmware
75 Siemens scalance_wub762-1_ifeatures
1 Netapp active_iq_unified_manager
2 Netapp h410c_firmware
3 Netapp a700s_firmware
4 Netapp oncommand_workflow_automation
5 Netapp snapmanager
6 Netapp h300s_firmware
7 Netapp h500s_firmware
8 Netapp h700s_firmware
9 Netapp h410s_firmware
10 Netapp a250_firmware
11 Netapp 500f_firmware
12 Netapp bootstrap_os
13 Netapp hci_compute_node
14 Netapp h300s
15 Netapp h410s
16 Netapp h500s
17 Netapp h700s
18 Netapp h410c
19 Netapp ontap_9
20 Netapp c250_firmware
21 Netapp a700s
22 Netapp a250
23 Netapp 500f
24 Netapp c250
1 Debian debian_linux
1 Openssl openssl
: Total Affected Vendor : 4 | Products : 101
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 134c704f-9b21-4f2e-91b3-4a467353bcc0
CVSS 3.1 MEDIUM 134c704f-9b21-4f2e-91b3-4a467353bcc0
Solution
Update OpenSSL and related packages to remediate a TLSv1.3 server denial-of-service vulnerability.
  • Update the affected OpenSSL packages to the latest versions.
  • If applicable, upgrade IBM MQ to the latest LTS versions.
  • Apply the appropriate vendor patches as needed.
Public PoC/Exploit Available at Github

CVE-2024-2511 has a 11 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-2511.

URL Resource
https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce Patch
https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d Patch
https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08 Patch
https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640 Permissions Required
https://www.openssl.org/news/secadv/20240408.txt Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/04/08/5 Mailing List Third Party Advisory
https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce Patch
https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d Patch
https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08 Patch
https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640 Permissions Required
https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20240503-0013/ Third Party Advisory
https://www.openssl.org/news/secadv/20240408.txt Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-265688.html Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-354112.html Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-398330.html Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-613116.html Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-769027.html Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-915275.html Third Party Advisory
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-2511 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2024-2511 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
mayanbennoun/nginx-dropin-secure

None

Dockerfile Shell Makefile Python

Updated: 5 months ago
0 stars 0 fork 0 watcher
Born at : May 29, 2026, 6:26 p.m. This repo has been linked 40 different CVEs too.
Profile Photo
BarAppTeam/nginx-cve-fix

None

Dockerfile Makefile Shell Python

Updated: 5 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : May 16, 2026, 7:57 p.m. This repo has been linked 24 different CVEs too.
Profile Photo
awiseguy88/openclaw-advanced-skills-library

OpenClaw Skills Library 2,510 Production-Ready Skills for AI Agent Automation Give your OpenClaw agent the complete puzzle. Modular, observable, and safe automation workflows for Ubuntu Linux systems. Built for professionals who need reliability.

Updated: 8 months, 2 weeks ago
2 stars 0 fork 0 watcher
Born at : Feb. 17, 2026, 5:05 p.m. This repo has been linked 602 different CVEs too.
Profile Photo
Vincent9956/Container-Security

Standalone Container Security Tests

Updated: 1 year ago
0 stars 0 fork 0 watcher
Born at : Oct. 21, 2025, 11:33 a.m. This repo has been linked 81 different CVEs too.
Profile Photo
ardhiatno/ubimicro-fluentbit

Fluentbit container image built as small as possible with security in mind

docker-image dockerfile fluent-bit

Dockerfile

Updated: 2 years ago
0 stars 0 fork 0 watcher
Born at : Oct. 22, 2024, 8:40 a.m. This repo has been linked 42 different CVEs too.
Profile Photo
Srinu-rj/spring-food-app

None

Dockerfile Roff Java

Updated: 2 years, 1 month ago
0 stars 0 fork 0 watcher
Born at : Oct. 7, 2024, 8:52 a.m. This repo has been linked 127 different CVEs too.
Profile Photo
mmbazm/secure_license_server

None

Dockerfile Python

Updated: 1 year, 11 months ago
0 stars 0 fork 0 watcher
Born at : Oct. 5, 2024, 4:56 p.m. This repo has been linked 68 different CVEs too.
Profile Photo
jtgorny/cve-scanning

Container Vulnerability Analysis tooling

Dockerfile Shell

Updated: 2 years, 4 months ago
0 stars 0 fork 0 watcher
Born at : June 10, 2024, 3:01 p.m. This repo has been linked 7 different CVEs too.
Profile Photo
GrigGM/05-virt-04-docker-hw

None

HCL

Updated: 2 years, 6 months ago
0 stars 0 fork 0 watcher
Born at : April 30, 2024, 7:53 p.m. This repo has been linked 54 different CVEs too.
Profile Photo
chnzzh/OpenSSL-CVE-lib

None

Updated: 3 months, 2 weeks ago
7 stars 0 fork 0 watcher
Born at : Feb. 23, 2023, 5:42 a.m. This repo has been linked 479 different CVEs too.
Profile Photo
bcgov/jag-cdds

CDDS webMethods Retirement Project

webmethods-retirement ag pssg java springboot

Java Dockerfile

Updated: 1 year, 11 months ago
1 stars 5 fork 5 watcher
Born at : Oct. 20, 2021, 8:39 p.m. This repo has been linked 4 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-2511 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2024-2511 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Nov. 06, 2026

    Action Type Old Value New Value
    Added CPE Configuration OR *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.0.0 up to (excluding) 3.0.14 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.1.0 up to (excluding) 3.1.6 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.2.0 up to (excluding) 3.2.2 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.1.1 up to (including) 1.1.1x
    Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* *cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* *cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:* *cpe:2.3:a:netapp:ontap_9:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:* OR cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netapp:500f_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:netapp:500f:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netapp:c250_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:netapp:c250:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.1.1 OR cpe:2.3:h:siemens:simatic_s7-1500_tm_mfp:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:ruggedcom_rm1224_lte(4g)_eu_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:ruggedcom_rm1224_lte(4g)_eu:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:ruggedcom_rm1224_lte(4g)_nam_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:ruggedcom_rm1224_lte(4g)_nam:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_m804pb_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_m804pb:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_m812-1_adsl-router_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_m812-1_adsl-router:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_m816-1_adsl-router_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_m816-1_adsl-router:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_m826-2_shdsl-router_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_m826-2_shdsl-router:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_m874-2_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_m874-2:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_m874-3_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_m874-3:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_m874-3_3g-router_(cn)_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_m874-3_3g-router_(cn):-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_m876-3_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_m876-3:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_m876-3_(rok)_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_m876-3_(rok):-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_m876-4_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_m876-4:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_m876-4_(eu)_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_m876-4_(eu):-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_m876-4_(nam)_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_m876-4_(nam):-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_mum853-1_(a1)_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_mum853-1_(a1):-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_mum853-1_(b1)_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_mum853-1_(b1):-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_mum853-1_(eu)_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_mum853-1_(eu):-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_mum856-1_(a1)_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_mum856-1_(a1):-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_mum856-1_(b1)_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_mum856-1_(b1):-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_mum856-1_(cn)_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_mum856-1_(cn):-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_mum856-1_(eu)_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_mum856-1_(eu):-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_mum856-1_(row)_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_mum856-1_(row):-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_s615_eec_lan-router_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_s615_eec_lan-router:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_s615_lan-router_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 8.2 OR cpe:2.3:h:siemens:scalance_s615_lan-router:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn/dp_firmware:*:*:*:*:*:*:*:* versions from (including) 3.1.0 up to (excluding) 3.1.5 OR cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4_pn/dp_mfp:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:sinec_os:*:*:*:*:*:*:*:* versions up to (excluding) 3.1 OR cpe:2.3:h:siemens:ruggedcom_rst2428p:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:sinec_os:*:*:*:*:*:*:*:* versions up to (excluding) 3.1 OR cpe:2.3:h:siemens:ruggedcom_rst2428p:-:*:*:*:*:*:*:* cpe:2.3:h:siemens:scalance_xcm324:-:*:*:*:*:*:*:* cpe:2.3:h:siemens:scalance_xcm328:-:*:*:*:*:*:*:* cpe:2.3:h:siemens:scalance_xcm332:-:*:*:*:*:*:*:* cpe:2.3:h:siemens:scalance_xrh334:-:*:*:*:*:*:*:* cpe:2.3:h:siemens:scalance_xrm334:-:*:*:*:*:*:*:* cpe:2.3:h:siemens:scalance_xcm323:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_wab762-1_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.0.0 OR cpe:2.3:h:siemens:scalance_wab762-1:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_wam763-1_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.0.0 OR cpe:2.3:h:siemens:scalance_wam763-1:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_wam766-1_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.0.0 OR cpe:2.3:h:siemens:scalance_wam766-1:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_wub762-1_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.0.0 OR cpe:2.3:h:siemens:scalance_wub762-1:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_wub762-1_ifeatures_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.0.0 OR cpe:2.3:h:siemens:scalance_wub762-1_ifeatures:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_wum763-1_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.0.0 OR cpe:2.3:h:siemens:scalance_wum763-1:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_wum766-1_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.0.0 OR cpe:2.3:h:siemens:scalance_wum766-1:-:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* *cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:* versions up to (excluding) 1.0 *cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:* *cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:* *cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_1:*:*:*:*:*:* *cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_2:*:*:*:*:*:*
    Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce Types: Patch
    Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d Types: Patch
    Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08 Types: Patch
    Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2024/04/08/5 Types: Mailing List, Third Party Advisory
    Added Reference Type OpenSSL Software Foundation: https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640 Types: Permissions Required
    Added Reference Type OpenSSL Software Foundation: https://www.openssl.org/news/secadv/20240408.txt Types: Vendor Advisory
    Added Reference Type CVE: https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce Types: Patch
    Added Reference Type CVE: https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d Types: Patch
    Added Reference Type CVE: https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08 Types: Patch
    Added Reference Type siemens-SADP: https://cert-portal.siemens.com/productcert/html/ssa-265688.html Types: Third Party Advisory
    Added Reference Type siemens-SADP: https://cert-portal.siemens.com/productcert/html/ssa-354112.html Types: Third Party Advisory
    Added Reference Type siemens-SADP: https://cert-portal.siemens.com/productcert/html/ssa-398330.html Types: Third Party Advisory
    Added Reference Type CVE: https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640 Types: Permissions Required
    Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html Types: Mailing List, Third Party Advisory
    Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html Types: Mailing List, Third Party Advisory
    Added Reference Type CVE: https://security.netapp.com/advisory/ntap-20240503-0013/ Types: Third Party Advisory
    Added Reference Type CVE: https://www.openssl.org/news/secadv/20240408.txt Types: Vendor Advisory
    Added Reference Type siemens-SADP: https://cert-portal.siemens.com/productcert/html/ssa-613116.html Types: Third Party Advisory
    Added Reference Type siemens-SADP: https://cert-portal.siemens.com/productcert/html/ssa-769027.html Types: Third Party Advisory
    Added Reference Type siemens-SADP: https://cert-portal.siemens.com/productcert/html/ssa-915275.html Types: Third Party Advisory
  • CVE Modified by 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

    Oct. 15, 2026

    Action Type Old Value New Value
    Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2024/2xxx/CVE-2024-2511.json">CVE-2024-2511</a>
    Added Reference https://cert-portal.siemens.com/productcert/html/ssa-265688.html
    Added Reference https://cert-portal.siemens.com/productcert/html/ssa-354112.html
    Added Reference https://cert-portal.siemens.com/productcert/html/ssa-398330.html
    Added Reference https://cert-portal.siemens.com/productcert/html/ssa-613116.html
    Added Reference https://cert-portal.siemens.com/productcert/html/ssa-769027.html
    Added Reference https://cert-portal.siemens.com/productcert/html/ssa-915275.html
    Removed Reference https://cert-portal.siemens.com/productcert/html/ssa-265688.html
    Removed Reference https://cert-portal.siemens.com/productcert/html/ssa-354112.html
    Removed Reference https://cert-portal.siemens.com/productcert/html/ssa-398330.html
    Removed Reference https://cert-portal.siemens.com/productcert/html/ssa-613116.html
    Removed Reference https://cert-portal.siemens.com/productcert/html/ssa-769027.html
    Removed Reference https://cert-portal.siemens.com/productcert/html/ssa-915275.html
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Oct. 15, 2026

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2024/04/08/5
    Added Reference https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce
    Added Reference https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d
    Added Reference https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08
    Added Reference https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640
    Added Reference https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html
    Added Reference https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html
    Added Reference https://security.netapp.com/advisory/ntap-20240503-0013/
    Added Reference https://www.openssl.org/news/secadv/20240408.txt
    Removed Reference http://www.openwall.com/lists/oss-security/2024/04/08/5
    Removed Reference https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce
    Removed Reference https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d
    Removed Reference https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08
    Removed Reference https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640
    Removed Reference https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html
    Removed Reference https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html
    Removed Reference https://security.netapp.com/advisory/ntap-20240503-0013/
    Removed Reference https://www.openssl.org/news/secadv/20240408.txt
  • CVE Modified by [email protected]

    Oct. 15, 2026

    Action Type Old Value New Value
    Added Reference https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce
    Added Reference https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d
    Added Reference https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08
    Added Reference https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640
    Added Reference https://www.openssl.org/news/secadv/20240408.txt
    Removed Reference https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce
    Removed Reference https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d
    Removed Reference https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08
    Removed Reference https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640
    Removed Reference https://www.openssl.org/news/secadv/20240408.txt
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Jun. 17, 2026

    Action Type Old Value New Value
    Added SSVC {'id': 'CVE-2024-2511', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2024-04-09T15:14:41.481807Z'}
  • CVE Modified by 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

    Jun. 17, 2026

    Action Type Old Value New Value
    Added Affected [{'vendor': 'Siemens', 'product': 'RUGGEDCOM RM1224 LTE(4G) EU', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'RUGGEDCOM RM1224 LTE(4G) NAM', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'RUGGEDCOM RST2428P', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V3.1', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE M804PB', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE M812-1 ADSL-Router', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE M812-1 ADSL-Router', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE M816-1 ADSL-Router', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE M816-1 ADSL-Router', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE M826-2 SHDSL-Router', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE M874-2', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE M874-3', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE M874-3 3G-Router (CN)', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE M876-3', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE M876-3 (ROK)', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE M876-4', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE M876-4 (EU)', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE M876-4 (NAM)', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE MUM853-1 (A1)', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE MUM853-1 (B1)', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE MUM853-1 (EU)', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE MUM856-1 (A1)', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE MUM856-1 (B1)', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE MUM856-1 (CN)', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE MUM856-1 (EU)', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE MUM856-1 (RoW)', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE S615 EEC LAN-Router', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE S615 LAN-Router', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V8.2', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family', 'versions': [{'status': 'unaffected', 'version': '0', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SCALANCE XCM-/XRM-/XCH-/XRH-300 family', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'V3.1', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 TM MFP - GNU/Linux subsystem', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.0', 'lessThan': 'V3.1.5', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.0', 'lessThan': 'V3.1.5', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.0', 'lessThan': 'V3.1.5', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.0', 'lessThan': 'V3.1.5', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIPLUS S7-1500 CPU 1518-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.0', 'lessThan': 'V3.1.5', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}]
  • CVE Modified by [email protected]

    Jun. 17, 2026

    Action Type Old Value New Value
    Added Affected [{'vendor': 'OpenSSL', 'product': 'OpenSSL', 'versions': [{'status': 'affected', 'version': '3.2.0', 'lessThan': '3.2.2', 'versionType': 'semver'}, {'status': 'affected', 'version': '3.1.0', 'lessThan': '3.1.6', 'versionType': 'semver'}, {'status': 'affected', 'version': '3.0.0', 'lessThan': '3.0.14', 'versionType': 'semver'}, {'status': 'affected', 'version': '1.1.1', 'lessThan': '1.1.1y', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}]
  • CVE Modified by 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

    May. 12, 2026

    Action Type Old Value New Value
    Added Reference https://cert-portal.siemens.com/productcert/html/ssa-265688.html
    Added Reference https://cert-portal.siemens.com/productcert/html/ssa-354112.html
    Added Reference https://cert-portal.siemens.com/productcert/html/ssa-398330.html
    Added Reference https://cert-portal.siemens.com/productcert/html/ssa-613116.html
    Added Reference https://cert-portal.siemens.com/productcert/html/ssa-769027.html
    Added Reference https://cert-portal.siemens.com/productcert/html/ssa-915275.html
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 03, 2025

    Action Type Old Value New Value
    Added Reference https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html
    Added Reference https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Mar. 28, 2025

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2024/04/08/5
    Added Reference https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce
    Added Reference https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d
    Added Reference https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08
    Added Reference https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640
    Added Reference https://security.netapp.com/advisory/ntap-20240503-0013/
    Added Reference https://www.openssl.org/news/secadv/20240408.txt
  • CVE Modified by [email protected]

    Oct. 14, 2024

    Action Type Old Value New Value
    Removed Reference OpenSSL Software Foundation http://www.openwall.com/lists/oss-security/2024/04/08/5
    Removed Reference OpenSSL Software Foundation https://security.netapp.com/advisory/ntap-20240503-0013/
    Added CWE OpenSSL Software Foundation CWE-1325
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    May. 03, 2024

    Action Type Old Value New Value
    Added Reference OpenSSL Software Foundation https://security.netapp.com/advisory/ntap-20240503-0013/ [No types assigned]
  • CVE Modified by [email protected]

    May. 01, 2024

    Action Type Old Value New Value
    Added Reference OpenSSL Software Foundation http://www.openwall.com/lists/oss-security/2024/04/08/5 [No types assigned]
  • CVE Received by [email protected]

    Apr. 08, 2024

    Action Type Old Value New Value
    Added Description Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.
    Added Reference OpenSSL Software Foundation https://www.openssl.org/news/secadv/20240408.txt [No types assigned]
    Added Reference OpenSSL Software Foundation https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08 [No types assigned]
    Added Reference OpenSSL Software Foundation https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce [No types assigned]
    Added Reference OpenSSL Software Foundation https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d [No types assigned]
    Added Reference OpenSSL Software Foundation https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640 [No types assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
Base CVSS Score: 5.9
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact