PT-2025-35816 · Adacore · Adacore Ada Web Server

Published 2025-09-03 · Updated 2025-09-08 · CVE-2025-52494

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Adacore Ada Web Server (AWS) versions prior to 25.2

Description The Adacore Ada Web Server (AWS) is susceptible to a denial-of-service (DoS) condition resulting from improper handling of SSL handshakes during connection initialization. The server lacks a specific timeout for the SSL handshake phase, relying on an effectively infinite default socket timeout. An attacker can exploit this by sending a malformed TLS ClientHello message with incorrect length values, causing the server to indefinitely wait for data. By establishing multiple such connections, an attacker can exhaust available worker threads, preventing the server from processing legitimate requests.

Recommendations Update to version 25.2 or later.

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2025-52494

Affected Products

Adacore Ada Web Server

References · 7

• https://osv.dev/vulnerability/CVE-2025-52494 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52494 · Security Note
• https://docs.adacore.com/corp/security-advisories/SEC.AWS-0095-v1.pdf · Vendor Advisory
• https://adacore.com · Note
• https://t.me/cveNotify/134674 · Telegram Post
• https://twitter.com/CVEnew/status/1963296324297568683 · Twitter Post
• https://t.me/CVEtracker/31625 · Telegram Post