CVE-2025-66199

/// Technical description

Issue summary: A TLS 1.3 connection using certificate compression can be

forced to allocate a large buffer before decompression without checking

against the configured certificate size limit.

Impact summary: An attacker can cause per-connection memory allocations of

up to approximately 22 MiB and extra CPU work, potentially leading to

service degradation or resource exhaustion (Denial of Service).

In affected configurations, the peer-supplied uncompressed certificate

length from a CompressedCertificate message is used to grow a heap buffer

prior to decompression. This length is not bounded by the max_cert_list

setting, which otherwise constrains certificate message sizes. An attacker

can exploit this to cause large per-connection allocations followed by

handshake failure. No memory corruption or information disclosure occurs.

This issue only affects builds where TLS 1.3 certificate compression is

compiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression

algorithm (bro

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References