CVE-2021-34433

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-20 · updated 2026-06-17
Weakness: CWE-322

Description

In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in the server's ServerKeyExchange.

Affected products

The Eclipse Foundation Eclipse Californium: from 2.0.0 before 2.6.5; 3.0.0-m1, 3.0.0-m2, 3.0.0-m3 — fixed in 2.6.5

How to fix

Upgrade to a fixed version: The Eclipse Foundation Eclipse Californium 2.6.5. Check the vendor advisory for mitigations.

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=575281
https://bugs.eclipse.org/bugs/show_bug.cgi?id=575281

Get alerted when CVE-2021-34433 or the next vulnerability affects your stack