EUVD-2026-40054
GHSA-qqgj-g5f7-jqhm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated DTLS epoch-0 handshake path; no privileges or interaction required; only availability impact confirmed, no integrity or confidentiality effect established.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
1DescriptionCVE.org
Eclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 contains an out-of-bounds read vulnerability in the check_server_certificate() function that allows unauthenticated attackers to trigger reads beyond valid buffer boundaries by crafting a Certificate handshake message with a specific fragment_length value. Attackers can exploit missing buffer length validation before uint24 reads, memcmp, and memcpy operations during DTLS epoch 0 on both client and server paths to cause denial of service on memory-constrained devices.
AnalysisAI
Out-of-bounds read in Eclipse tinydtls prior to commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 allows unauthenticated network attackers to crash memory-constrained IoT devices by sending a specially crafted Certificate handshake message during DTLS epoch 0. The vulnerable check_server_certificate() function omits buffer length validation before uint24 reads, memcmp, and memcpy operations, enabling reads beyond valid buffer boundaries on both client and server code paths. No public exploit code or active exploitation has been identified at time of analysis; however, the unauthenticated, network-reachable nature makes this straightforward to trigger against any exposed tinydtls endpoint.
Technical ContextAI
Eclipse tinydtls is a lightweight Datagram Transport Layer Security (DTLS) implementation designed for resource-constrained devices in IoT and embedded environments. The vulnerability is rooted in CWE-125 (Out-of-bounds Read): the check_server_certificate() function does not validate that the buffer is sufficiently large before reading a 3-byte unsigned integer (uint24), passing buffer regions to memcmp, or copying data with memcpy. This occurs during DTLS epoch 0, which is the unencrypted pre-authentication handshake phase, meaning no session establishment or credential check gatekeeps the attack. The affected CPE is cpe:2.3:a:eclipse_foundation:eclipse_tinydtls:*:*:*:*:*:*:*:* - the wildcard version range indicates all releases prior to the fix commit are affected. The tags list 'Information Disclosure' alongside Denial of Service, consistent with CWE-125 behavior where OOB reads may expose adjacent memory content in addition to causing crashes.
RemediationAI
The primary fix is to update Eclipse tinydtls to a version that includes commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221, which adds buffer length validation before the uint24 reads, memcmp, and memcpy operations in check_server_certificate(). A released tagged version number containing this fix has not been independently confirmed from available data - verify against the upstream repository at the Eclipse security advisory (https://gitlab.eclipse.org/security/cve-assignment/-/work_items/112) before deploying. If patching is not immediately possible, deployments that do not require DTLS certificate-based handshakes can disable or restrict Certificate message processing as a compensating control, though this may break mutual TLS authentication flows. Network-level filtering to restrict DTLS traffic (UDP) to trusted peers only reduces the attack surface but does not eliminate the vulnerability for threat models involving untrusted network participants.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today