Vulnerability-Lookup

VDE-2025-109

Vulnerability from csaf_phoenixcontactgmbhcokg - Published: 2026-02-10 08:00 - Updated: 2026-02-23 14:00

Summary

Phoenix Contact: Unbounded growth of the session cache in TCP encapsulation service in FL MGUARD 2xxx and 4xxx firmware

Severity

Medium

Notes

Summary: The OpenSSL library used in the affected products is vulnerable to an unbounded growth of the session cache in the TLSv1.3 implementation.

Impact: A remote attacker can exhaust all the memory by establishing a large number of TLSv1.3 connections to the TCP encapsulation service, causing the device to reboot.

Mitigation: It is recommended to disable TCP encapsulation on affected mGuard devices and use Pathfinder instead.

Remediation: Phoenix Contact strongly recommends upgrading affected mGuard devices to firmware version 10.6.0 or higher which fixes this vulnerability.

General Recommendation: For general information and recommendations on security measures refer to the mGuard documentation: https://help.mguard.com/en/documentation.

Product Description: mGuards are industrial routers and security appliances

CVE-2024-2511

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-1325 - Improperly Controlled Sequential Memory Allocation

Mitigation It is recommended to disable TCP encapsulation on affected mGuard devices and use Pathfinder instead.

Vendor Fix Phoenix Contact recommends upgrading the firmware of affected mGuard devices to version 10.6.0 or higher, which fixes the vulnerability.

References

URL

Category

	https://phoenixcontact.com/psirt	external
	https://certvde.com/de/advisories/vendor/phoenixcontact	external
	https://certvde.com/en/advisories/VDE-2025-109	self
	https://phoenixcontact.csaf-tp.certvde.com/.well-…	self

Acknowledgments

CERT@VDE certvde.com

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "Medium"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "The OpenSSL library used in the affected products is vulnerable to an unbounded growth of the session cache in the TLSv1.3 implementation.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "A remote attacker can exhaust all the memory by establishing a large number of TLSv1.3 connections to the TCP encapsulation service, causing the device to reboot.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "It is recommended to disable TCP encapsulation on affected mGuard devices and use Pathfinder instead.",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "Phoenix Contact strongly recommends upgrading affected mGuard devices to firmware version 10.6.0 or higher which fixes this vulnerability.",
        "title": "Remediation"
      },
      {
        "category": "general",
        "text": "For general information and recommendations on security measures refer to the mGuard documentation: https://help.mguard.com/en/documentation.",
        "title": "General Recommendation"
      },
      {
        "category": "description",
        "text": "mGuards are industrial routers and security appliances",
        "title": "Product Description"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@phoenixcontact.com",
      "name": "Phoenix Contact GmbH \u0026 Co. KG",
      "namespace": "https://phoenixcontact.com/psirt"
    },
    "references": [
      {
        "category": "external",
        "summary": "PCSA-2025-00024",
        "url": "https://phoenixcontact.com/psirt"
      },
      {
        "category": "external",
        "summary": "Phoenix Contact advisory overview at CERT@VDE",
        "url": "https://certvde.com/de/advisories/vendor/phoenixcontact"
      },
      {
        "category": "self",
        "summary": "VDE-2025-109: Phoenix Contact: Unbounded growth of the session cache in TCP encapsulation service in FL MGUARD 2xxx and 4xxx firmware - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2025-109"
      },
      {
        "category": "self",
        "summary": "VDE-2025-109: Phoenix Contact: Unbounded growth of the session cache in TCP encapsulation service in FL MGUARD 2xxx and 4xxx firmware - CSAF",
        "url": "https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-109.json"
      }
    ],
    "title": "Phoenix Contact: Unbounded growth of the session cache in TCP encapsulation service in FL MGUARD 2xxx and 4xxx firmware",
    "tracking": {
      "aliases": [
        "VDE-2025-109",
        "PCSA-2025-00024"
      ],
      "current_release_date": "2026-02-23T14:00:00.000Z",
      "generator": {
        "date": "2026-02-23T13:33:51.512Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.43"
        }
      },
      "id": "VDE-2025-109",
      "initial_release_date": "2026-02-10T08:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-02-10T08:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial release."
        },
        {
          "date": "2026-02-23T14:00:00.000Z",
          "number": "1.0.1",
          "summary": "Updated category type in product tree."
        }
      ],
      "status": "final",
      "version": "1.0.1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "FL MGUARD 2102",
                "product": {
                  "name": "FL MGUARD 2102",
                  "product_id": "CSAFPID-11001",
                  "product_identification_helper": {
                    "model_numbers": [
                      "1357828"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "FL MGUARD 2105",
                "product": {
                  "name": "FL MGUARD 2105",
                  "product_id": "CSAFPID-11002",
                  "product_identification_helper": {
                    "model_numbers": [
                      "1357850"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "FL MGUARD 4302",
                "product": {
                  "name": "FL MGUARD 4302",
                  "product_id": "CSAFPID-11003",
                  "product_identification_helper": {
                    "model_numbers": [
                      "1357840"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "FL MGUARD 4305",
                "product": {
                  "name": "FL MGUARD 4305",
                  "product_id": "CSAFPID-11004",
                  "product_identification_helper": {
                    "model_numbers": [
                      "1357875"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "FL MGUARD 4102 PCIE",
                "product": {
                  "name": "FL MGUARD 4102 PCIE",
                  "product_id": "CSAFPID-11005",
                  "product_identification_helper": {
                    "model_numbers": [
                      "1357842"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "FL MGUARD 4102 PCI",
                "product": {
                  "name": "FL MGUARD 4102 PCI",
                  "product_id": "CSAFPID-11006",
                  "product_identification_helper": {
                    "model_numbers": [
                      "1441187"
                    ]
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.5.0",
                "product": {
                  "name": "Firmware 10.5.0",
                  "product_id": "CSAFPID-21001",
                  "product_identification_helper": {
                    "model_numbers": [
                      "1357828",
                      "1357850",
                      "1357840",
                      "1357875",
                      "1357842",
                      "1441187"
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "10.6.0",
                "product": {
                  "name": "Firmware 10.6.0",
                  "product_id": "CSAFPID-22001",
                  "product_identification_helper": {
                    "model_numbers": [
                      "1357828",
                      "1357850",
                      "1357840",
                      "1357875",
                      "1357842",
                      "1441187"
                    ]
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "Phoenix Contact"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0.0",
                "product": {
                  "name": "OpenSSL 3.0.0",
                  "product_id": "CSAFPID-51001",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:-:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "3.0.14",
                "product": {
                  "name": "OpenSSL 3.0.14",
                  "product_id": "CSAFPID-52001",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:openssl:openssl:3.0.14:-:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "3.0.13",
                "product": {
                  "name": "OpenSSL 3.0.13",
                  "product_id": "CSAFPID-51002",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:openssl:openssl:3.0.13:-:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenSSL"
          }
        ],
        "category": "vendor",
        "name": "OpenSSL Software Foundation"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-51001",
          "CSAFPID-51002"
        ],
        "summary": "Affected Products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-52001"
        ],
        "summary": "Fixed Products."
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 10.5.0 installed on FL MGUARD 2102",
          "product_id": "CSAFPID-31001",
          "product_identification_helper": {
            "model_numbers": [
              "1357828"
            ]
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 10.5.0 installed on FL MGUARD 2105",
          "product_id": "CSAFPID-31002",
          "product_identification_helper": {
            "model_numbers": [
              "1357850"
            ]
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 10.5.0 installed on FL MGUARD 4302",
          "product_id": "CSAFPID-31003",
          "product_identification_helper": {
            "model_numbers": [
              "1357840"
            ]
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 10.5.0 installed on FL MGUARD 4305",
          "product_id": "CSAFPID-31004",
          "product_identification_helper": {
            "model_numbers": [
              "1357875"
            ]
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 10.5.0 installed on FL MGUARD 4102 PCIE",
          "product_id": "CSAFPID-31005",
          "product_identification_helper": {
            "model_numbers": [
              "1357842"
            ]
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 10.5.0 installed on FL MGUARD 4102 PCI",
          "product_id": "CSAFPID-31006",
          "product_identification_helper": {
            "model_numbers": [
              "1441187"
            ]
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 10.6.0 installed on FL MGUARD 2102",
          "product_id": "CSAFPID-32001",
          "product_identification_helper": {
            "model_numbers": [
              "1357828"
            ]
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 10.6.0 installed on FL MGUARD 2105",
          "product_id": "CSAFPID-32002",
          "product_identification_helper": {
            "model_numbers": [
              "1357850"
            ]
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 10.6.0 installed on FL MGUARD 4302",
          "product_id": "CSAFPID-32003",
          "product_identification_helper": {
            "model_numbers": [
              "1357840"
            ]
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 10.6.0 installed on FL MGUARD 4305",
          "product_id": "CSAFPID-32004",
          "product_identification_helper": {
            "model_numbers": [
              "1357875"
            ]
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 10.6.0 installed on FL MGUARD 4102 PCIE",
          "product_id": "CSAFPID-32005",
          "product_identification_helper": {
            "model_numbers": [
              "1357842"
            ]
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 10.6.0 installed on FL MGUARD 4102 PCI",
          "product_id": "CSAFPID-32006",
          "product_identification_helper": {
            "model_numbers": [
              "1441187"
            ]
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11006"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-2511",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.",
          "title": "CVE Description"
        },
        {
          "audience": "all",
          "category": "details",
          "text": "This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients.",
          "title": "CVE Details"
        },
        {
          "audience": "operational management and system administrators",
          "category": "details",
          "text": "An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service",
          "title": "CVE Impact"
        },
        {
          "audience": "Operational management and system administrators",
          "category": "details",
          "text": "The OpenSSL library as used in the TCP encapsulation service of affected products, is vulnerable to an unbounded growth of the session cache in the TLSv1.3 implementation.\n\nA remote attacker can exhaust all memory by establishing a large number of TLSv1.3 connections to the TCP encapsulation service, causing the device to reboot.\n\nIn the device context, there are two deviations from the original CVSS assessment. An attack - although complex to achieve - can generally be automated, which leads to a rating of low Attack Complexity (AC:L). A successful attack has a temporary effect on the availability of the device, as an automatic reboot occurs when the RAM is fully utilized (A:L).",
          "title": "CVE Characterisation"
        }
      ],
      "product_status": {
        "first_affected": [
          "CSAFPID-51001"
        ],
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-52001"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-51001",
          "CSAFPID-51002"
        ],
        "last_affected": [
          "CSAFPID-51002"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "It is recommended to disable TCP encapsulation on affected mGuard devices and use Pathfinder instead.",
          "group_ids": [
            "CSAFGID-0001"
          ],
          "restart_required": {
            "category": "service"
          }
        },
        {
          "category": "vendor_fix",
          "date": "2025-11-14T10:00:00.000Z",
          "details": "Phoenix Contact recommends upgrading the firmware of affected mGuard devices to version 10.6.0 or higher, which fixes the vulnerability.",
          "group_ids": [
            "CSAFGID-0001"
          ],
          "restart_required": {
            "category": "system"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.9,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001",
            "CSAFPID-51002"
          ]
        },
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.3,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006"
          ]
        }
      ],
      "title": "Unbounded memory growth with session handling in TLSv1.3"
    }
  ]
}

CVE-2024-2511 (GCVE-0-2024-2511)

Vulnerability from cvelistv5 – Published: 2024-04-08 13:51 – Updated: 2025-11-03 21:54

Title

Unbounded memory growth with session handling in TLSv1.3

Summary

Severity ?

No CVSS data available.

CWE

CWE-1325 - Improperly Controlled Sequential Memory Allocation

Assigner

openssl

References

URL

Tags

	https://www.openssl.org/news/secadv/20240408.txt	vendor-advisory
	https://github.com/openssl/openssl/commit/e9d7083…	patch
	https://github.com/openssl/openssl/commit/7e4d731…	patch
	https://github.com/openssl/openssl/commit/b52867a…	patch
	https://github.openssl.org/openssl/extended-relea…	patch

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Affected: 3.2.0 , < 3.2.2 (semver) Affected: 3.1.0 , < 3.1.6 (semver) Affected: 3.0.0 , < 3.0.14 (semver) Affected: 1.1.1 , < 1.1.1y (custom)

Date Public ?

2024-04-08 00:00

Credits

Manish Patidar (Hewlett Packard Enterprise) Matt Caswell

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-2511",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-09T15:14:41.481807Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-28T19:21:08.630Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:54:02.419Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "OpenSSL Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20240408.txt"
          },
          {
            "name": "3.2.2 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08"
          },
          {
            "name": "3.1.6 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce"
          },
          {
            "name": "3.0.14 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d"
          },
          {
            "name": "1.1.1y git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/04/08/5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240503-0013/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.2.2",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.1.6",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.14",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1y",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Manish Patidar (Hewlett Packard Enterprise)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Matt Caswell"
        }
      ],
      "datePublic": "2024-04-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: Some non-default TLS server configurations can cause unbounded\u003cbr\u003ememory growth when processing TLSv1.3 sessions\u003cbr\u003e\u003cbr\u003eImpact summary: An attacker may exploit certain server configurations to trigger\u003cbr\u003eunbounded memory growth that would lead to a Denial of Service\u003cbr\u003e\u003cbr\u003eThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\u003cbr\u003ebeing used (but not if early_data support is also configured and the default\u003cbr\u003eanti-replay protection is in use). In this case, under certain conditions, the\u003cbr\u003esession cache can get into an incorrect state and it will fail to flush properly\u003cbr\u003eas it fills. The session cache will continue to grow in an unbounded manner. A\u003cbr\u003emalicious client could deliberately create the scenario for this failure to\u003cbr\u003eforce a Denial of Service. It may also happen by accident in normal operation.\u003cbr\u003e\u003cbr\u003eThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\u003cbr\u003eclients.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\u003cbr\u003e1.0.2 is also not affected by this issue."
            }
          ],
          "value": "Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://www.openssl.org/policies/secpolicy.html"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1325",
              "description": "CWE-1325 Improperly Controlled Sequential Memory Allocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-14T14:56:00.208Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.openssl.org/news/secadv/20240408.txt"
        },
        {
          "name": "3.2.2 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08"
        },
        {
          "name": "3.1.6 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce"
        },
        {
          "name": "3.0.14 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d"
        },
        {
          "name": "1.1.1y git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unbounded memory growth with session handling in TLSv1.3",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2024-2511",
    "datePublished": "2024-04-08T13:51:12.349Z",
    "dateReserved": "2024-03-15T15:33:52.037Z",
    "dateUpdated": "2025-11-03T21:54:02.419Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VDE-2025-109

CVE-2024-2511 (GCVE-0-2024-2511)

Tags

Sightings

Nomenclature