CVE-2021-44718 Denial of service in n/a
An attacker in a Man-in-the-Middle position can cause a denial of service and infinite loop in the wolfSSL client by sending crafted TLS messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-44718?
CVE-2021-44718 is a medium-severity denial of service vulnerability in Wolfssl Wolfssl, published on 2 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle (MITM) position. The root cause is that the client module accepts TLS messages that normally are only sent to TLS servers.
Weakness: CWE-835
Which versions are affected by CVE-2021-44718?
It affects 1 product.
Products include Wolfssl Wolfssl.
How do I fix CVE-2021-44718?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-44718 being exploited?
There is no known exploitation of CVE-2021-44718 in the wild and no public exploit code.
Other vulnerabilities in Wolfssl Wolfssl
Sources
Also known as DEBIAN-CVE-2021-44718, GHSA-9m99-gmcj-9g66, JLSEC-2026-668, UBUNTU-CVE-2021-44718.