Resource Management Errors Affecting openssl package, versions [1.0.2u,1.1.0l)


Severity

Recommended
0.0
medium
0
10

CVSS assessment by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
18.98% (95th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CONAN-OPENSSL-10078012
  • published8 May 2025
  • disclosed26 Sept 2016
  • creditUnknown

Introduced: 26 Sep 2016

CVE-2016-6308  (opens in a new tab)
CWE-399  (opens in a new tab)

How to fix?

Upgrade openssl to version 1.1.0l or higher.

Overview

Affected versions of this package are vulnerable to Resource Management Errors statem/statem_dtls.c in the DTLS implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow remote attackers to cause a denial of service (memory consumption) via crafted DTLS messages.

References

CVSS Base Scores

version 3.1