PT-2026-4945 · Openssl+5 · Openssl 3.5+9

Stanislav Fort + 1 · Published 2025-01-01 · Updated 2026-04-27 · CVE-2025-66199

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenSSL versions 3.3 through 3.6

Description A TLS 1.3 connection utilizing certificate compression can be manipulated to allocate a substantial buffer prior to decompression, bypassing the configured certificate size limit. This can lead to per-connection memory allocations of approximately 22 MiB and increased CPU usage, potentially causing service degradation or denial of service. The issue arises from the uncompressed certificate length supplied by the peer in a CompressedCertificate message being used to expand a heap buffer without being constrained by the max cert list setting. This affects clients receiving a server CompressedCertificate and servers in mutual TLS scenarios receiving a client CompressedCertificate. Servers that do not request client certificates are not susceptible to client-initiated attacks.

Recommendations OpenSSL version 3.3: Set SSL OP NO RX CERTIFICATE COMPRESSION to disable receiving compressed certificates. OpenSSL version 3.4: Set SSL OP NO RX CERTIFICATE COMPRESSION to disable receiving compressed certificates. OpenSSL version 3.5: Set SSL OP NO RX CERTIFICATE COMPRESSION to disable receiving compressed certificates. OpenSSL version 3.6: Set SSL OP NO RX CERTIFICATE COMPRESSION to disable receiving compressed certificates.

Fix

DoS

Weakness Enumeration

CWE-789

Related Identifiers

ALSA-2026:1472

ALSA-2026:1473

AZL-75284

BDU:2026-01212

CVE-2025-66199

JLSEC-2026-260

OPENSUSE-SU-2026:10237-1

OPENSUSE-SU-2026:20152-1

RHSA-2026:1472

RHSA-2026:1473

RHSA-2026:7261

SUSE-SU-2026:20211-1

SUSE-SU-2026:20223-1

USN-7980-1

Affected Products

Freebsd

Linuxmint

Openssl 3.3

Openssl 3.4

Openssl 3.5

Openssl 3.6

Openssl

Red Os

Rocky Linux

Ubuntu

References · 110

• https://github.com/openssl/openssl/commit/895150b5e021d16b52fb32b97e1dd12f20448be5 · Patch
• https://github.com/openssl/openssl/commit/6184a4fb08ee6d7bca570d931a4e8bef40b64451 · Patch
• https://github.com/openssl/openssl/commit/3ed1f75249932b155eef993a8e66a99cb98bfef4 · Patch
• https://github.com/openssl/openssl/commit/966a2478046c311ed7dae50c457d0db4cafbf7e4 · Patch
• https://osv.dev/vulnerability/ALPINE-CVE-2025-66199 · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2026-1472.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66199 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66199 · Security Note
• https://bdu.fstec.ru/vul/2026-01212 · Security Note
• https://errata.rockylinux.org/RLSA-2026:1473 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-66199 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68160 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20211-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20223-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-69419 · Vendor Advisory