HIGH🇵🇱 Wersja polska

CVE-2022-2576

CVSS 7.5v3.1pub. 2022-07-29upd. 2024-11-21

In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without using a HelloVerifyRequest. Especially, if used with certificate based cipher suites, that results in message amplification (DDoS other peers) and high CPU load (DoS own peer). The misbehavior occurs only with DTLS_VERIFY_PEERS_ON_RESUMPTION_THRESHOLD values larger than 0.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

  • Eclipse Californium

    APP
    Eclipse
    2.0.0 – 2.7.23.0.0 – 3.5.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-39368HIGH8.2same product

Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud servi...

CVE-2021-34433HIGH7.5same product

In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) D...

CVE-2020-27222HIGH7.5same product

In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidental...

CVE-2026-12605CRITICAL9.6PL ✓same vendor

Eclipse GlassFish: CSRF+SSRF w DownloadServlet umożliwia przejęcie domeny

CVE-2026-60007CRITICAL9.1PL ✓same vendor

Eclipse Milo: padding oracle w uwierzytelnianiu OPC-UA umożliwia odzyskanie hasła