TLS 1.3 Certificate Compression Vulnerability in OpenSSL

CVE-2025-66199

What is CVE-2025-66199?

A significant vulnerability exists in OpenSSL's implementation of TLS 1.3 that allows attackers to exploit certificate compression to cause excessive memory allocation before decompression. By supplying uncompressed certificates of arbitrary length, an attacker may induce up to 22 MiB of per-connection memory allocation and increased CPU utilization, potentially resulting in service degradation or resource exhaustion without causing memory corruption or data leakage. This issue affects configurations where TLS 1.3 certificate compression is enabled and certain compression algorithms are available. Mitigation includes disabling certificate compression via SSL_OP_NO_RX_CERTIFICATE_COMPRESSION for affected systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References