CVE-2025-66199 — Memory Allocation with Excessive Size Value in Openssl
Severity
5.9MEDIUMNVD
OSV6.1
EPSS
0.1%
top 79.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 27
Latest updateApr 10
Description
Issue summary: A TLS 1.3 connection using certificate compression can be
forced to allocate a large buffer before decompression without checking
against the configured certificate size limit.
Impact summary: An attacker can cause per-connection memory allocations of
up to approximately 22 MiB and extra CPU work, potentially leading to
service degradation or resource exhaustion (Denial of Service).
In affected configurations, the peer-supplied uncompressed certificate
length from a CompressedCe…
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6
Affected Packages5 packages
Patches
🔴Vulnerability Details
6📋Vendor Advisories
5🕵️Threat Intelligence
1💬Community
6Bugzilla▶
CVE-2025-66199 sslscan: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [epel-10]↗2026-04-10
Bugzilla▶
CVE-2025-66199 openssl3: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [epel-8]↗2026-04-10
Bugzilla▶
CVE-2025-66199 edk2: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [fedora-43]↗2026-04-10
Bugzilla▶
CVE-2025-66199 sslscan: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [epel-9]↗2026-04-10
Bugzilla▶
CVE-2025-66199 sslscan: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [fedora-all]↗2026-04-10