CVE-2025-66199
LowSummary
A vulnerability in TLS 1.3 with certificate compression can force a large buffer allocation before decompression without checking the configured certificate size limit. An attacker can cause per-connection memory allocations of up to approximately 22 MiB.
Risk Assessment
The risk is excessive memory consumption on the server or client, potentially leading to resource exhaustion and denial of service (DoS).
Recommendation
Update to a patched version of the library and monitor memory allocations in TLS connections.
Original NVD description (English source)
Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit. Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and e