WaratekVRT Sign in

CVE-2024-2511 OpenSSL

Affected softwareOpenSSL
Severity5.9 Medium CVSS 3.1
WeaknessCWE-1325
Published8 Apr 2024
Updated6 Nov 2026

Description

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.

Exploitation status

Forecast only (59% 30-day chance)

No exploit has been reported in the sources we check. EPSS puts this CVE in the top 0.87% of all scored CVEs. That is a model's forecast, not a report of exploitation.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 59% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Security Patch Update August 2026 ↗ CSPU 2026-Q3 Oracle Commerce / Forge (OpenSSL) (11.4.0)
Oracle Critical Patch Update January 2025 ↗ CPU 2025-Q1 Oracle PeopleSoft / Security, Porting, Cloud Deployment Architecture (OpenSSL) (8.60, 8.61)
Oracle Critical Patch Update October 2024 ↗ CPU 2024-Q4 Oracle Financial Services Applications / Common (OpenSSL) (14.7.4.0.0)
Oracle Fusion Middleware / Web Listener (OpenSSL) (12.2.1.4.0)
Oracle Critical Patch Update July 2024 ↗ CPU 2024-Q3 Oracle Financial Services Applications / Common (OpenSSL) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Commerce Forge (OpenSSL) 11.4.0 11.4.0
Oracle Financial Services Applications Common (OpenSSL) 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 · 14.7.4.0.0
Oracle Fusion Middleware Web Listener (OpenSSL) 12.2.1.4.0 12.2.1.4.0
Oracle PeopleSoft Security, Porting, Cloud Deployment Architecture (OpenSSL) 8.60, 8.61 8.60 · 8.61

Products and versions

51 products, 59 version entries
SourceVendorProductSchemeAffected versions
nvd debian debian linux generic 11.0
nvd netapp 500f firmware generic any version
nvd netapp a250 firmware generic any version
nvd netapp a700s firmware generic any version
nvd netapp active iq unified manager generic any version
nvd netapp bootstrap os generic any version
nvd netapp c250 firmware generic any version
nvd netapp h300s firmware generic any version
nvd netapp h410c firmware generic any version
nvd netapp h410s firmware generic any version
nvd netapp h500s firmware generic any version
nvd netapp h700s firmware generic any version
nvd netapp oncommand workflow automation generic any version
nvd netapp ontap 9 generic any version
nvd netapp snapmanager generic any version
nvd openssl openssl generic ≥ 1.1.1 and ≤ 1.1.1 · ≥ 3.0.0 and ＜ 3.0.14 · ≥ 3.1.0 and ＜ 3.1.6 · ≥ 3.2.0 and ＜ 3.2.2
nvd siemens ruggedcom rm1224 lte\(4g\) eu firmware generic ＜ 8.2
nvd siemens ruggedcom rm1224 lte\(4g\) nam firmware generic ＜ 8.2
nvd siemens scalance m804pb firmware generic ＜ 8.2
nvd siemens scalance m812-1 adsl-router firmware generic ＜ 8.2
nvd siemens scalance m816-1 adsl-router firmware generic ＜ 8.2
nvd siemens scalance m826-2 shdsl-router firmware generic ＜ 8.2
nvd siemens scalance m874-2 firmware generic ＜ 8.2
nvd siemens scalance m874-3 3g-router \(cn\) firmware generic ＜ 8.2
nvd siemens scalance m874-3 firmware generic ＜ 8.2
nvd siemens scalance m876-3 \(rok\) firmware generic ＜ 8.2
nvd siemens scalance m876-3 firmware generic ＜ 8.2
nvd siemens scalance m876-4 \(eu\) firmware generic ＜ 8.2
nvd siemens scalance m876-4 \(nam\) firmware generic ＜ 8.2
nvd siemens scalance m876-4 firmware generic ＜ 8.2
nvd siemens scalance mum853-1 \(a1\) firmware generic ＜ 8.2
nvd siemens scalance mum853-1 \(b1\) firmware generic ＜ 8.2
nvd siemens scalance mum853-1 \(eu\) firmware generic ＜ 8.2
nvd siemens scalance mum856-1 \(a1\) firmware generic ＜ 8.2
nvd siemens scalance mum856-1 \(b1\) firmware generic ＜ 8.2
nvd siemens scalance mum856-1 \(cn\) firmware generic ＜ 8.2
nvd siemens scalance mum856-1 \(eu\) firmware generic ＜ 8.2
nvd siemens scalance mum856-1 \(row\) firmware generic ＜ 8.2
nvd siemens scalance s615 eec lan-router firmware generic ＜ 8.2
nvd siemens scalance s615 lan-router firmware generic ＜ 8.2
nvd siemens scalance wab762-1 firmware generic ＜ 3.0.0
nvd siemens scalance wam763-1 firmware generic ＜ 3.0.0
nvd siemens scalance wam766-1 firmware generic ＜ 3.0.0
nvd siemens scalance wub762-1 firmware generic ＜ 3.0.0
nvd siemens scalance wub762-1 ifeatures firmware generic ＜ 3.0.0
nvd siemens scalance wum763-1 firmware generic ＜ 3.0.0
nvd siemens scalance wum766-1 firmware generic ＜ 3.0.0
nvd siemens simatic s7-1500 cpu 1518-4 pn\/dp firmware generic ≥ 3.1.0 and ＜ 3.1.5
nvd siemens simatic s7-1500 tm mfp firmware generic ＜ 1.1.1
nvd siemens sinec ins generic 1.0 · ＜ 1.0 · 1.0:sp1 · 1.0:sp2 · 1.0:sp2_update_1 · 1.0:sp2_update_2
nvd siemens sinec os generic ＜ 3.1

References

URLTags
https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce Patch
https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d Patch
https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08 Patch
https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640 Permissions Required
https://www.openssl.org/news/secadv/20240408.txt Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/04/08/5 Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20240503-0013/ Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-265688.html Third Party Advisory

Timeline
Published2024-04-08By the CVE Program.
NVD record modified2026-11-06NVD's own last-modified date for this record.