CVE-2016-8610

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS

39.66% chance of exploitation in the next 30 days, 99th percentile

Published

2017-11-13

Updated

2024-08-06

Proof-of-concept exploits (1)

• cujanovic/CVE-2016-8610-PoC33★ · 2016-12-28

References

• CVE Record
• NVD entry

Related

• CVE-2016-8600
• CVE-2016-8641
• CVE-2016-8593
• CVE-2016-8654
• CVE-2016-8592
• CVE-2016-8655