Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-g8at-dasq-h3fb
Vulnerability ID VCID-g8at-dasq-h3fb
Aliases CVE-2025-66199
Summary openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression
Status Published
Exploitability 0.5
Weighted Severity 5.3
Risk 2.6
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-770 Allocation of Resources Without Limits or Throttling
CWE-789 Memory Allocation with Excessive Size Value
System Score Found at
cvssv3 5.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-66199.json
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2025-66199
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2025-66199
epss 0.00067 https://api.first.org/data/v1/epss?cve=CVE-2025-66199
epss 0.00067 https://api.first.org/data/v1/epss?cve=CVE-2025-66199
epss 0.00067 https://api.first.org/data/v1/epss?cve=CVE-2025-66199
epss 0.00067 https://api.first.org/data/v1/epss?cve=CVE-2025-66199
epss 0.00067 https://api.first.org/data/v1/epss?cve=CVE-2025-66199
epss 0.00067 https://api.first.org/data/v1/epss?cve=CVE-2025-66199
epss 0.00067 https://api.first.org/data/v1/epss?cve=CVE-2025-66199
epss 0.00067 https://api.first.org/data/v1/epss?cve=CVE-2025-66199
epss 0.00067 https://api.first.org/data/v1/epss?cve=CVE-2025-66199
epss 0.00067 https://api.first.org/data/v1/epss?cve=CVE-2025-66199
epss 0.00067 https://api.first.org/data/v1/epss?cve=CVE-2025-66199
epss 0.00067 https://api.first.org/data/v1/epss?cve=CVE-2025-66199
cvssv3.1 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 5.9 https://github.com/openssl/openssl/commit/3ed1f75249932b155eef993a8e66a99cb98bfef4
ssvc Track https://github.com/openssl/openssl/commit/3ed1f75249932b155eef993a8e66a99cb98bfef4
cvssv3.1 5.9 https://github.com/openssl/openssl/commit/6184a4fb08ee6d7bca570d931a4e8bef40b64451
ssvc Track https://github.com/openssl/openssl/commit/6184a4fb08ee6d7bca570d931a4e8bef40b64451
cvssv3.1 5.9 https://github.com/openssl/openssl/commit/895150b5e021d16b52fb32b97e1dd12f20448be5
ssvc Track https://github.com/openssl/openssl/commit/895150b5e021d16b52fb32b97e1dd12f20448be5
cvssv3.1 5.9 https://github.com/openssl/openssl/commit/966a2478046c311ed7dae50c457d0db4cafbf7e4
ssvc Track https://github.com/openssl/openssl/commit/966a2478046c311ed7dae50c457d0db4cafbf7e4
cvssv3.1 5.9 https://openssl-library.org/news/secadv/20260127.txt
ssvc Track https://openssl-library.org/news/secadv/20260127.txt
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-66199.json
https://api.first.org/data/v1/epss?cve=CVE-2025-66199
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
20260127.txt https://openssl-library.org/news/secadv/20260127.txt
2430379 https://bugzilla.redhat.com/show_bug.cgi?id=2430379
3ed1f75249932b155eef993a8e66a99cb98bfef4 https://github.com/openssl/openssl/commit/3ed1f75249932b155eef993a8e66a99cb98bfef4
6184a4fb08ee6d7bca570d931a4e8bef40b64451 https://github.com/openssl/openssl/commit/6184a4fb08ee6d7bca570d931a4e8bef40b64451
895150b5e021d16b52fb32b97e1dd12f20448be5 https://github.com/openssl/openssl/commit/895150b5e021d16b52fb32b97e1dd12f20448be5
966a2478046c311ed7dae50c457d0db4cafbf7e4 https://github.com/openssl/openssl/commit/966a2478046c311ed7dae50c457d0db4cafbf7e4
RHSA-2026:1472 https://access.redhat.com/errata/RHSA-2026:1472
RHSA-2026:1473 https://access.redhat.com/errata/RHSA-2026:1473
RHSA-2026:1736 https://access.redhat.com/errata/RHSA-2026:1736
RHSA-2026:2485 https://access.redhat.com/errata/RHSA-2026:2485
RHSA-2026:2563 https://access.redhat.com/errata/RHSA-2026:2563
RHSA-2026:3228 https://access.redhat.com/errata/RHSA-2026:3228
RHSA-2026:4943 https://access.redhat.com/errata/RHSA-2026:4943
RHSA-2026:7261 https://access.redhat.com/errata/RHSA-2026:7261
USN-7980-1 https://usn.ubuntu.com/7980-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-66199.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/openssl/openssl/commit/3ed1f75249932b155eef993a8e66a99cb98bfef4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-29T15:03:12Z/ Found at https://github.com/openssl/openssl/commit/3ed1f75249932b155eef993a8e66a99cb98bfef4
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/openssl/openssl/commit/6184a4fb08ee6d7bca570d931a4e8bef40b64451
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-29T15:03:12Z/ Found at https://github.com/openssl/openssl/commit/6184a4fb08ee6d7bca570d931a4e8bef40b64451
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/openssl/openssl/commit/895150b5e021d16b52fb32b97e1dd12f20448be5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-29T15:03:12Z/ Found at https://github.com/openssl/openssl/commit/895150b5e021d16b52fb32b97e1dd12f20448be5
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/openssl/openssl/commit/966a2478046c311ed7dae50c457d0db4cafbf7e4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-29T15:03:12Z/ Found at https://github.com/openssl/openssl/commit/966a2478046c311ed7dae50c457d0db4cafbf7e4
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://openssl-library.org/news/secadv/20260127.txt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-29T15:03:12Z/ Found at https://openssl-library.org/news/secadv/20260127.txt
Exploit Prediction Scoring System (EPSS)
Percentile 0.20107
EPSS Score 0.00064
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:32:17.142349+00:00 RedHat Importer Import https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-66199.json 38.0.0