← 返回地图破甲

Unbounded memory growth with session handling in TLSv1.3

拒绝服务 / Allocation of Resources Without Limits or Throttling / #2622671

厂商
Internet Bug Bounty
严重程度
低危
赏金
$497
弱点
Allocation of Resources Without Limits or Throttling
研究员
@manishpatidar
披露日期
2024-09-22
资产
https://github.com/openssl/openssl
CVE
CVE-2024-2511

该报告还没有中文解读。

原文摘录

摘自原文(1914 字符中的一小部分)
Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。

时间线

阅读 HackerOne 原文 ↗作者 @manishpatidar · 版权归作者与 Internet Bug Bounty 所有

同类报告

CVE-2024-41990: Potential denial-of-service in django.utils.html.urlize()Internet Bug Bounty · 2024-11-30 · $2,162High resource consumption by insufficient sanitization of forum threads paginationFlickr · 2025-11-24 · $479Memory Leak in libcurl via Location Header Handling (CWE-770)curl · 2025-05-22Security check upcurl · 2025-07-24HTTP/3 paused transfer buffers incoming data without bound up to ~1 GiBcurl · 2026-05-19CVE-2024-56374 Potential denial-of-service in IPv6 validationInternet Bug Bounty · 2025-02-06