CVE-2020-27222

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-03 · updated 2026-06-17
Weakness: CWE-372

Description

In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS server side sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DTLS handshake failure with TLS parameter mismatch. The DTLS server side must be restarted to recover this. This allow clients to force a DoS.

Affected products

The Eclipse Foundation Eclipse Californium: from 2.3.0 through 2.6.0

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=570844
https://bugs.eclipse.org/bugs/show_bug.cgi?id=570844

Get alerted when CVE-2020-27222 or the next vulnerability affects your stack