VDB
GCVE-110-MAGEIA-2022-415
GCVE-110-MAGEIA-2022-415
Advisory Published
An unauthenticated remote host could send an invalid ClientHello message in
which the declared length of the cookie extends past the end of the message.
A DTLS server with MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled would read past
the end of the message up to the declared length of the cookie. This could
cause a buffer overread of up to 255 bytes on the heap in vulnerable DTLS
servers, which may lead to a crash or to information disclosure via the
cookie check function (CVE-2022-35409).
This issue has been patched, backporting a fix from upstream's 2.28.0 release.
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Mageia | mbedtls | 2.16.12-1.1.mga8 (unaffected), 0 (affected) | — |
Aliases
Browse GCVE Records
72,921 records in the GCVE database · Updated July 15, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.