Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

wolfSSL CyaSSL may crash on malformed certificates

CVE-2014-2899 · published 12 years ago
Summary

When wolfSSL CyaSSL (versions earlier than 2.9.4) receives a badly formed certificate or a client_key_exchange message with a missing temporary key, it can cause the software to stop working. This means a remote user could make the service unavailable. Update to the latest version of wolfSSL CyaSSL to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
yassl cyassl <= 2.9.0
0.2.0
0.3.0
0.4.0
0.5.0
0.5.5
0.6.0
0.6.2
0.6.3
0.8.0
0.9.0
0.9.6
29 more version ranges
cpe:2.3:a:yassl:cyassl:*:*:*:*:*:*:*:*
Original advisory text
wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (...
wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchange message when the ephemeral key is not found.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published22 Apr 2014
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2014-2899 · NVD
Track software like this
Free during beta