Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-6925

wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or traffic amplification) via a crafted DTLS cookie in a ClientHello message.

Published

2016-01-22T15:59:03.507

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-399

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	wolfssl	wolfssl	≤ 3.6.6	Yes

References

http://wolfssl.com/wolfSSL/Docs-wolfssl-changelog.html ([email protected])
https://github.com/IAIK/wolfSSL-DoS Exploit ([email protected])
https://wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html Exploit, Vendor Advisory ([email protected])
http://wolfssl.com/wolfSSL/Docs-wolfssl-changelog.html (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/IAIK/wolfSSL-DoS Exploit (af854a3a-2127-422b-91ae-364da2661108)
https://wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html Exploit, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)