CVE-2009-1377

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 11.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-05-19 · updated 2026-06-16
Weakness: CWE-119

Description

The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."

Affected products

OpenSSL: from 0.9.8 before 0.9.8m — fixed in 0.9.8m

How to fix

Upgrade to a fixed version: OpenSSL 0.9.8m. Check the vendor advisory for mitigations.

References

http://cvs.openssl.org/chngview?cn=18187
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
http://lists.vmware.com/pipermail/security-announce/2010/000082.html
http://marc.info/?l=openssl-dev&m=124247675613888&w=2
http://rt.openssl.org/Ticket/Display.html?id=1930&user=guest&pass=guest
http://secunia.com/advisories/35128
http://secunia.com/advisories/35416
http://secunia.com/advisories/35461
http://secunia.com/advisories/35571
http://secunia.com/advisories/35729

Get alerted when CVE-2009-1377 or the next vulnerability affects your stack