OpenSSL up to 3.3.5/3.4.3/3.5.4/3.6.0 CompressedCertificate Message memory allocation

Summaryinfo

A vulnerability was found in OpenSSL up to 3.3.5/3.4.3/3.5.4/3.6.0. It has been classified as problematic. The affected element is an unknown function of the component CompressedCertificate Message Handler. The manipulation leads to memory allocation. This vulnerability is traded as CVE-2025-66199. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in OpenSSL up to 3.3.5/3.4.3/3.5.4/3.6.0. This issue affects an unknown code block of the component CompressedCertificate Message Handler. The manipulation with an unknown input leads to a memory allocation vulnerability. Using CWE to declare the problem leads to CWE-789. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. Impacted is availability. The summary by CVE is:

Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit. Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service). In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate message is used to grow a heap buffer prior to decompression. This length is not bounded by the max_cert_list setting, which otherwise constrains certificate message sizes. An attacker can exploit this to cause large per-connection allocations followed by handshake failure. No memory corruption or information disclosure occurs. This issue only affects builds where TLS 1.3 certificate compression is compiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression algorithm (brotli, zlib, or zstd) is available, and where the compression extension is negotiated. Both clients receiving a server CompressedCertificate and servers in mutual TLS scenarios receiving a client CompressedCertificate are affected. Servers that do not request client certificates are not vulnerable to client-initiated attacks. Users can mitigate this issue by setting SSL_OP_NO_RX_CERTIFICATE_COMPRESSION to disable receiving compressed certificates. The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the TLS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue. OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

It is possible to read the advisory at openssl-library.org. The identification of this vulnerability is CVE-2025-66199 since 11/24/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/09/2026).

The vulnerability scanner Nessus provides a plugin with the ID 297022 (RHEL 9 : openssl (RHSA-2026:1473)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.3.6, 3.4.4, 3.5.5 or 3.6.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (297022) and CERT Bund (WID-SEC-2026-0234). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• IBM VIOS
• IBM AIX
• Debian Linux
• Google Cloud Platform
• IBM DataPower Gateway
• Amazon Linux 2
• Red Hat Enterprise Linux
• NetApp Data ONTAP
• Siemens SIMATIC WinCC
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• IGEL OS
• IBM QRadar SIEM
• SUSE openSUSE
• Fabasoft Cloud
• RESF Rocky Linux
• IBM App Connect Enterprise
• Dell BIOS
• Dell PowerScale OneFS
• Siemens SIMATIC STEP 7
• Open Source OpenSSL
• Broadcom Brocade SANnav
• Fortinet FortiPortal
• Meinberg LANTIME
• Red Hat OpenShift
• IBM MQ
• Open Source Camunda
• ABB AC-500
• Dell Secure Connect Gateway
• IBM InfoSphere Information Server
• Splunk Splunk Enterprise
• Phoenix Contact FL MGUARD
• Phoenix Contact FL SWITCH
• Phoenix Contact TC ROUTER
• Dell integrated Dell Remote Access Controller
• Siemens SIMATIC S7
• Insyde UEFI Firmware
• NCP Secure Enterprise VPN Server

Productinfo

Type

• Network Encryption Software

Name

• OpenSSL

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.3.5
• 3.4
• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.5
• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3
• 3.5.4
• 3.6.0

License

• open-source

Website

• Product: https://www.openssl.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion