CVE-2025-66199
published 2026-01-27CVE-2025-66199: Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the…
PriorityP431medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
0.40%
32.5th percentile
Issue summary: A TLS 1.3 connection using certificate compression can be
forced to allocate a large buffer before decompression without checking
against the configured certificate size limit.
Impact summary: An attacker can cause per-connection memory allocations of
up to approximately 22 MiB and extra CPU work, potentially leading to
service degradation or resource exhaustion (Denial of Service).
In affected configurations, the peer-supplied uncompressed certificate
length from a CompressedCertificate message is used to grow a heap buffer
prior to decompression. This length is not bounded by the max_cert_list
setting, which otherwise constrains certificate message sizes. An attacker
can exploit this to cause large per-connection allocations followed by
handshake failure. No memory corruption or information disclosure occurs.
This issue only affects builds where TLS 1.3 certificate compression is
compiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression
algorithm (brotli, zlib, or zstd) is available, and where the compression
extension is negotiated. Both clients receiving a server CompressedCertificate
and servers in mutual TLS scenarios receiving a client CompressedCertificate
are affected. Servers that do not request client certificates are not
vulnerable to client-initiated attacks.
Users can mitigate this issue by setting SSL_OP_NO_RX_CERTIFICATE_COMPRESSION
to disable receiving compressed certificates.
The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,
as the TLS implementation is outside the OpenSSL FIPS module boundary.
OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.
OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openssl | < openssl 3.5.5-1 (forky) | openssl 3.5.5-1 (forky) |
| openssl | openssl | >= 0 < 3.3.6-r0 | 3.3.6-r0 |
| openssl | openssl | >= 0 < 3.3.6-r0 | 3.3.6-r0 |
| openssl | openssl | >= 0 < 3.5.5-r0 | 3.5.5-r0 |
| openssl | openssl | >= 0 < 3.5.5-r0 | 3.5.5-r0 |
| openssl | openssl | >= 0 < 3.5.4-1~deb13u2 | 3.5.4-1~deb13u2 |
| openssl | openssl | >= 0 < 3.5.5-1 | 3.5.5-1 |
| openssl | openssl | >= 0 < 3.0.2-0ubuntu1.21 | 3.0.2-0ubuntu1.21 |
| openssl | openssl | >= 0 < 3.0.13-0ubuntu3.7 | 3.0.13-0ubuntu3.7 |
| openssl | openssl | >= 0 < 3.5.3-1ubuntu3 | 3.5.3-1ubuntu3 |
| openssl | openssl | >= 0 < 1.0.1f-1ubuntu2.27+esm12 | 1.0.1f-1ubuntu2.27+esm12 |
| openssl | openssl | >= 0 < 1.0.2g-1ubuntu4.20+esm14 | 1.0.2g-1ubuntu4.20+esm14 |
| openssl | openssl | >= 0 < 1.1.1-1ubuntu2.1~18.04.23+esm7 | 1.1.1-1ubuntu2.1~18.04.23+esm7 |
| openssl | openssl | >= 0 < 1.1.1f-1ubuntu2.24+esm2 | 1.1.1f-1ubuntu2.24+esm2 |
| openssl | openssl | >= 3.3.0 < 3.3.6 | 3.3.6 |
| openssl | openssl | >= 3.4.0 < 3.4.4 | 3.4.4 |
| openssl | openssl | >= 3.5.0 < 3.5.5 | 3.5.5 |
| openssl | openssl | >= 3.6.0 < 3.6.1 | 3.6.1 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
osv6.1MEDIUM
vendor_ubuntu6.1MEDIUM
vendor_debian5.9LOW
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression
vendor_redhat·2026-01-27·CVSS 5.9
CVE-2025-66199 [MEDIUM] CWE-770 openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression
openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression
Issue summary: A TLS 1.3 connection using certificate compression can be
forced to allocate a large buffer before decompression without checking
against the configured certificate size limit.
Impact summary: An attacker can cause per-connection memory allocations of
up to approximately 22 MiB and extra CPU work, potentially leading to
service degradation or resource exhaustion (Denial of Service).
In affected configurations, the peer-supplied uncompressed certificate
length from a CompressedCertificate message is used to grow a heap buffer
prior to decompression. This length is not bounded by the max_cert_list
setting, which otherwise constrains certificate message sizes. An attacker
Ubuntu
OpenSSL vulnerabilities
vendor_ubuntu·2026-01-27·CVSS 6.1
CVE-2025-69419 [MEDIUM] OpenSSL vulnerabilities
Title: OpenSSL vulnerabilities
Summary: Several security issues were fixed in OpenSSL.
USN-7980-1 fixed vulnerabilities in OpenSSL. This update provides the
corresponding updates for CVE-2025-68160 for openssl and openssl1.0,
CVE-2025-69418 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69419 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69420 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69421 for openssl and openssl1.0, CVE-2026-22795 for openssl on
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS, and CVE-2026-22796 for openssl and
openssl1.0.
Original advisory details:
Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL
incorrectly validated PBMAC1 parameters when doing PKCS#12 MAC
verification. An attacker could possibly use this
BSD
FreeBSD-SA-26:01.openssl: Multiple vulnerabilities in OpenSSL
bsd_advisories·2026-01-27·CVSS 6.1
CVE-2025-11187 [MEDIUM] FreeBSD-SA-26:01.openssl: Multiple vulnerabilities in OpenSSL
FreeBSD-SA-26:01.openssl Security Advisory
The FreeBSD Project
Topic: Multiple vulnerabilities in OpenSSL
Category: contrib
Module: openssl
Announced: 2026-01-27
Credits: Aisle Research
Affects: All supported versions of FreeBSD.
Corrected: 2026-01-27 19:14:58 UTC (stable/15, 15.0-STABLE)
2026-01-27 19:15:49 UTC (releng/15.0, 15.0-RELEASE-p2)
2026-01-27 19:15:10 UTC (stable/14, 14.3-STABLE)
2026-01-27 19:16:22 UTC (releng/14.3, 14.3-RELEASE-p8)
2026-01-27 19:15:19 UTC (stable/13, 13.4-STABLE)
2026-01-27 19:16:45 UTC (releng/13.5, 13.5-RELEASE-p9)
CVE Name: CVE-2025-11187, CVE-2025-15467, CVE-2025-15468,
CVE-2025-15469, CVE-2025-66199, CVE-2025-68160,
CVE-2025-69418, CVE-2025-69419, CVE-2025-69420,
CVE-2025-69421, CVE-2026-22795, CVE-2026-22796
For general information regarding FreeBSD S
Ubuntu
OpenSSL vulnerabilities
vendor_ubuntu·2026-01-27·CVSS 6.1
CVE-2025-66199 [MEDIUM] OpenSSL vulnerabilities
Title: OpenSSL vulnerabilities
Summary: Several security issues were fixed in OpenSSL.
Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL
incorrectly validated PBMAC1 parameters when doing PKCS#12 MAC
verification. An attacker could possibly use this issue to cause OpenSSL to
crash, resulting in a denial of service. This issue only affected Ubuntu
25.10. (CVE-2025-11187)
Stanislav Fort discovered that OpenSSL incorrectly parsed CMS
AuthEnvelopedData messages. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service. (CVE-2025-15467)
Stanislav Fort discovered that OpenSSL incorrectly handled memory in the
SSL_CIPHER_find() function. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of serv
Debian
CVE-2025-66199: openssl - Issue summary: A TLS 1.3 connection using certificate compression can be forced ...
vendor_debian·2025·CVSS 5.9
CVE-2025-66199 [MEDIUM] CVE-2025-66199: openssl - Issue summary: A TLS 1.3 connection using certificate compression can be forced ...
Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit. Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service). In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate message is used to grow a heap buffer prior to decompression. This length is not bounded by the max_cert_list setting, which otherwise constrains certificate message sizes. An attacker can exploit this to cause large per-connection allocations followed by handshake failure. No memory corrupt
OSV
openssl, openssl1.0 vulnerabilities
osv·2026-01-27·CVSS 6.1
CVE-2025-68160 [MEDIUM] openssl, openssl1.0 vulnerabilities
openssl, openssl1.0 vulnerabilities
USN-7980-2 fixed vulnerabilities in OpenSSL. This update provides the
corresponding updates for CVE-2025-68160 for openssl and openssl1.0,
CVE-2025-69418 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69419 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69420 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69421 for openssl and openssl1.0, CVE-2026-22795 for openssl on
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS, and CVE-2026-22796 for openssl and
openssl1.0.
Original advisory details:
Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL
incorrectly validated PBMAC1 parameters when doing PKCS#12 MAC
verification. An attacker could possibly use this issue to cause OpenSSL
to crash, resulting in a deni
OSV
CVE-2025-66199: Issue summary: A TLS 1
osv·2026-01-27·CVSS 5.9
CVE-2025-66199 [MEDIUM] CVE-2025-66199: Issue summary: A TLS 1
Issue summary: A TLS 1.3 connection using certificate compression can be
forced to allocate a large buffer before decompression without checking
against the configured certificate size limit.
Impact summary: An attacker can cause per-connection memory allocations of
up to approximately 22 MiB and extra CPU work, potentially leading to
service degradation or resource exhaustion (Denial of Service).
In affected configurations, the peer-supplied uncompressed certificate
length from a CompressedCertificate message is used to grow a heap buffer
prior to decompression. This length is not bounded by the max_cert_list
setting, which otherwise constrains certificate message sizes. An attacker
can exploit this to cause large per-connection allocations followed by
handshake failure. No memory corru
OSV
openssl vulnerabilities
osv·2026-01-27·CVSS 6.1
CVE-2025-11187 [MEDIUM] openssl vulnerabilities
openssl vulnerabilities
Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL
incorrectly validated PBMAC1 parameters when doing PKCS#12 MAC
verification. An attacker could possibly use this issue to cause OpenSSL to
crash, resulting in a denial of service. This issue only affected Ubuntu
25.10. (CVE-2025-11187)
Stanislav Fort discovered that OpenSSL incorrectly parsed CMS
AuthEnvelopedData messages. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service. (CVE-2025-15467)
Stanislav Fort discovered that OpenSSL incorrectly handled memory in the
SSL_CIPHER_find() function. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service. This issue only
affected Ubuntu 25.10. (CVE-2025-15468)
St
OSV
CVE-2025-66199: Issue summary: A TLS 1
osv·2026-01-27·CVSS 5.9
CVE-2025-66199 [MEDIUM] CVE-2025-66199: Issue summary: A TLS 1
Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit. Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service). In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate message is used to grow a heap buffer prior to decompression. This length is not bounded by the max_cert_list setting, which otherwise constrains certificate message sizes. An attacker can exploit this to cause large per-connection allocations followed by handshake failure. No memory corrupt
GHSA
GHSA-5888-36j9-c92p: Issue summary: A TLS 1
ghsa_unreviewed·2026-01-27
CVE-2025-66199 [MEDIUM] CWE-789 GHSA-5888-36j9-c92p: Issue summary: A TLS 1
Issue summary: A TLS 1.3 connection using certificate compression can be
forced to allocate a large buffer before decompression without checking
against the configured certificate size limit.
Impact summary: An attacker can cause per-connection memory allocations of
up to approximately 22 MiB and extra CPU work, potentially leading to
service degradation or resource exhaustion (Denial of Service).
In affected configurations, the peer-supplied uncompressed certificate
length from a CompressedCertificate message is used to grow a heap buffer
prior to decompression. This length is not bounded by the max_cert_list
setting, which otherwise constrains certificate message sizes. An attacker
can exploit this to cause large per-connection allocations followed by
handshake failure. No memory corru
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-66199 sslscan: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [epel-10]
bugzilla·2026-04-10·CVSS 5.9
CVE-2025-66199 [MEDIUM] CVE-2025-66199 sslscan: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [epel-10]
CVE-2025-66199 sslscan: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [epel-10]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2025-66199 openssl3: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [epel-8]
bugzilla·2026-04-10·CVSS 5.9
CVE-2025-66199 [MEDIUM] CVE-2025-66199 openssl3: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [epel-8]
CVE-2025-66199 openssl3: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [epel-8]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2025-66199 edk2: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [fedora-43]
bugzilla·2026-04-10·CVSS 5.9
CVE-2025-66199 [MEDIUM] CVE-2025-66199 edk2: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [fedora-43]
CVE-2025-66199 edk2: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
Fixed in edk2-20251119-9 and newer (built with openssl-3.5.5+).
Bugzilla
CVE-2025-66199 sslscan: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [epel-9]
bugzilla·2026-04-10·CVSS 5.9
CVE-2025-66199 [MEDIUM] CVE-2025-66199 sslscan: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [epel-9]
CVE-2025-66199 sslscan: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2025-66199 sslscan: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [fedora-all]
bugzilla·2026-04-10·CVSS 5.9
CVE-2025-66199 [MEDIUM] CVE-2025-66199 sslscan: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [fedora-all]
CVE-2025-66199 sslscan: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2025-66199 openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression
bugzilla·2026-01-16·CVSS 5.9
CVE-2025-66199 [MEDIUM] CVE-2025-66199 openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression
CVE-2025-66199 openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression
An attacker can cause per-connection memory allocations of
up to approximately 22 MiB and extra CPU work, potentially leading to
service degradation or resource exhaustion (Denial of Service).
In affected configurations, the peer-supplied uncompressed certificate
length from a CompressedCertificate message is used to grow a heap buffer
prior to decompression. This length is not bounded by the max_cert_list
setting, which otherwise constrains certificate message sizes. An attacker
can exploit this to cause large per-connection allocations followed by
handshake failure. No memory corruption or information disclosure occurs.
This issue only affects builds where TLS 1.3 c
Hackernews
OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests
blogs_hackernews·2026-07-18
CVE-2025-66199 OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests
Eleven bytes will make an unpatched OpenSSL server set aside up to 131 KB of memory for a message that never arrives. On the glibc systems Okta tested, that memory is gone until the process restarts.
OpenSSL shipped the HollowByte fix in June with no CVE, no advisory, and no changelog entry pointing at it. Okta's Red Team, which reported the denial-of-service bug and named it, published the details on Thursday.
The fixed releases are OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21 , all dated June 9. Every release on those branches before the fixed
Wiz
CVE-2025-66199 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2025-66199 [MEDIUM] CVE-2025-66199 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-66199 :
OpenSSL vulnerability analysis and mitigation
Issue summary: A TLS 1.3 connection using certificate compression can be
forced to allocate a large buffer before decompression without checking
against the configured certificate size limit.
Impact summary: An attacker can cause per-connection memory allocations of
up to approximately 22 MiB and extra CPU work, potentially leading to
service degradation or resource exhaustion (Denial of Service).
In affected configurations, the peer-supplied uncompressed certificate
length from a CompressedCertificate message is used to grow a heap buffer
prior to decompression. This length is not bounded by the max_cert_list
setting, which otherwise constrains certificate message sizes. An attacker
can exploit this to cause large per-c
https://github.com/openssl/openssl/commit/3ed1f75249932b155eef993a8e66a99cb98bfef4https://github.com/openssl/openssl/commit/6184a4fb08ee6d7bca570d931a4e8bef40b64451https://github.com/openssl/openssl/commit/895150b5e021d16b52fb32b97e1dd12f20448be5https://github.com/openssl/openssl/commit/966a2478046c311ed7dae50c457d0db4cafbf7e4https://openssl-library.org/news/secadv/20260127.txt
2026-01-27
Published