CVE-2022-2576

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without using a HelloVerifyRequest. Especially, if used with certificate based cipher suites, that results in message amplification (DDoS other peers) and high CPU load (DoS own peer). The misbehavior occurs only with DTLS_VERIFY_PEERS_ON_RESUMPTION_THRESHOLD values larger than 0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-408

Affected software

No affected versions have been published.

Timeline

Published
Jul 29, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-257609.8All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input saniCVE-2022-257617.5The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitCVE-2022-257628.6If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5CVE-2022-257637.5Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache CVE-2022-257659.8The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.CVE-2022-257668.8The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /apiCVE-2022-257679.8All versions of package com.bstek.ureport:ureport2-console are vulnerable to Remote Code Execution by connecting to a malicious database serCVE-2022-257686.5The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform thCVE-2022-257699.1ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the rooCVE-2022-25778.8A vulnerability classified as critical was found in SourceCodester Garage Management System 1.0. This vulnerability affects unknown code of CVE-2022-257707.5Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerCVE-2022-257726.1A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable