CVE-2024-2511: Unbounded memory growth with session handling in TLSv1.3
Vulnerability summary
CVE-2024-2511 is a medium (CVSS 5.9) vulnerability in openssl. EPSS estimates a 52.42% chance of exploitation in the next 30 days, higher than 98.9% of scored vulnerabilities.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 9Timeline
- 08-04-2024PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · AlpineEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
52.42%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 52.42% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse20 products
- openssl-1_1&distro=SUSE Enterprise Storage 7.1< 1.1.1d-150200.11.88.1
- openssl-1_1&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 1.1.1d-150200.11.88.1
- openssl-1_1&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 1.1.1d-150200.11.88.1
- openssl-1_1&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 1.1.1l-150400.7.66.2
- openssl-1_1&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 1.1.1l-150400.7.66.2
Opensuse6 products
- openssl-1_1&distro=openSUSE Leap 15.5< 1.1.1l-150500.17.28.2
- openssl-1_1&distro=openSUSE Leap Micro 5.3< 1.1.1l-150400.7.66.2
- openssl-1_1&distro=openSUSE Leap Micro 5.4< 1.1.1l-150400.7.66.2
- openssl-1_1&distro=openSUSE Tumbleweed< 1.1.1w-9.1
- openssl-3&distro=openSUSE Leap 15.5< 3.0.8-150500.5.30.1
Ubuntu4 products
- edk2All versions (No fix recorded) | < 2022.02-3ubuntu0.22.04.4 | < 2024.02-2ubuntu0.6
- nodejsAll versions (No fix recorded)
- openssl< 1.0.1f-1ubuntu2.27+esm16 | < 1.0.2g-1ubuntu4.20+esm18 | All versions (No fix recorded) | < 1.1.1-1ubuntu2.1~18.04.23+esm10 | < 1.1.1f-1ubuntu2.23 | < 3.0.2-0ubuntu1.17 | < 3.0.2-0ubuntu1.17+Fips1 | < 3.0.13-0ubuntu3.2
- openssl-fipsAll versions (No fix recorded) | < 3.0.13-0ubuntu3.6+Fips1
Chainguard3 products
- openssl< 3.3.0-r5
- openssl-provider-fipsAll versions (No fix recorded)
- openssl-provider-fips-3.1.2All versions (No fix recorded)
Alpine1 product
- openssl< 3.0.12-r5 | < 3.1.4-r6 | < 3.2.1-r2
Debian1 product
- openssl< 3.0.14-1~deb12u1 | < 3.2.2-1
Mageia1 product
- openssl< 3.0.13-1.mga9
Openssl1 product
- openssl≥ 3.2.0, < 3.2.2 | ≥ 3.1.0, < 3.1.6 | ≥ 3.0.0, < 3.0.14 | ≥ 1.1.1, < 1.1.1y
Wolfi1 product
- openssl< 3.3.0-r5
9 vendors · 38 products
