[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2025-66199":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":19,"aliases":20,"duplicate_of":9,"upstream":32,"downstream":33,"duplicates":55,"related":56,"reserved_at":9,"published_at":65,"modified_at":66,"state":67,"summary":68,"references_raw":77,"kevs":137,"epss":138,"epss_history":141,"metrics":413,"affected":431},"CVE-2025-66199","Issue summary: A TLS 1.3 connection using certificate compression can be\nforced to allocate a large buffer before decompression without checking\nagainst the configured certificate size limit.\n\nImpact summary: An attacker can cause per-connection memory allocations of\nup to approximately 22 MiB and extra CPU work, potentially leading to\nservice degradation or resource exhaustion (Denial of Service).\n\nIn affected configurations, the peer-supplied uncompressed certificate\nlength from a CompressedCertificate message is used to grow a heap buffer\nprior to decompression. This length is not bounded by the max_cert_list\nsetting, which otherwise constrains certificate message sizes. An attacker\ncan exploit this to cause large per-connection allocations followed by\nhandshake failure. No memory corruption or information disclosure occurs.\n\nThis issue only affects builds where TLS 1.3 certificate compression is\ncompiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression\nalgorithm (brotli, zlib, or zstd) is available, and where the compression\nextension is negotiated. Both clients receiving a server CompressedCertificate\nand servers in mutual TLS scenarios receiving a client CompressedCertificate\nare affected. Servers that do not request client certificates are not\nvulnerable to client-initiated attacks.\n\nUsers can mitigate this issue by setting SSL_OP_NO_RX_CERTIFICATE_COMPRESSION\nto disable receiving compressed certificates.\n\nThe FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,\nas the TLS implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-789","Memory Allocation with Excessive Size Value","The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.","weakness","Draft","Variant",[],[],[21,22,23,24,25,26,27,28,29,30,31],"DEBIAN-CVE-2025-66199","UBUNTU-CVE-2025-66199","ALPINE-CVE-2025-66199","CGA-8724-74qp-7vp4","CGA-282m-3qmm-fgxv","CGA-66w2-cc4v-7xcr","CGA-7vj7-gw6h-3j23","CGA-m3xj-h3rw-7r44","CGA-qh85-f6pq-4jfw","CGA-r229-cq59-2pc8","CGA-r9pq-2w3x-64gx",[],[34,36,38,40,42,43,44,45,47,49,51,53],{"_key":35},"SUSE-SU-2026:20211-1",{"_key":37},"SUSE-SU-2026:20223-1",{"_key":39},"OPENSUSE-SU-2026:10237-1",{"_key":41},"OPENSUSE-SU-2026:20152-1",{"_key":21},{"_key":23},{"_key":22},{"_key":46},"SUSE-SU-2026:3835-1",{"_key":48},"USN-7980-1",{"_key":50},"RHSA-2026:1472",{"_key":52},"RHSA-2026:1473",{"_key":54},"RHSA-2026:7261",[],[57,58,59,60,61,62,63],{"_key":35},{"_key":37},{"_key":39},{"_key":41},{"_key":46},{"_key":48},{"_key":64},"CGA-5H8H-83X5-5C7F","2026-01-27T16:01:22.399Z","2026-01-29T15:03:51.754Z","Analyzed",{"cisa_kev":69,"cisa_ransomware":69,"cisa_vendor":9,"epss_severity":70,"epss_score":71,"severity":72,"severity_score":73,"severity_version":74,"severity_source":75,"severity_vector":76,"severity_status":67},false,"low",0.00418,"medium",5.9,"v3.1","cve.org","CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",[78,87,93,97,101,105,110,116,120,124,129,133],{"url":79,"sources":80,"tags":84},"https://openssl-library.org/news/secadv/20260127.txt",[75,81,82,83],"nvd","osv_wolfi","osv_chainguard",[85,86],"Vendor Advisory","Advisory",{"url":88,"sources":89,"tags":90},"https://github.com/openssl/openssl/commit/6184a4fb08ee6d7bca570d931a4e8bef40b64451",[75,81,82,83],[91,92],"Patch","FIX",{"url":94,"sources":95,"tags":96},"https://github.com/openssl/openssl/commit/895150b5e021d16b52fb32b97e1dd12f20448be5",[75,81,82,83],[91,92],{"url":98,"sources":99,"tags":100},"https://github.com/openssl/openssl/commit/966a2478046c311ed7dae50c457d0db4cafbf7e4",[75,81,82,83],[91,92],{"url":102,"sources":103,"tags":104},"https://github.com/openssl/openssl/commit/3ed1f75249932b155eef993a8e66a99cb98bfef4",[75,81,82,83],[91,92],{"url":106,"sources":107,"tags":109},"https://security-tracker.debian.org/tracker/CVE-2025-66199",[108],"osv_debian",[86],{"url":111,"sources":112,"tags":114},"https://ubuntu.com/security/CVE-2025-66199",[113],"osv_ubuntu",[115],"REPORT",{"url":117,"sources":118,"tags":119},"https://www.cve.org/CVERecord?id=CVE-2025-66199",[113],[115],{"url":121,"sources":122,"tags":123},"https://ubuntu.com/security/notices/USN-7980-1",[113],[86],{"url":125,"sources":126,"tags":128},"https://security.alpinelinux.org/vuln/CVE-2025-66199",[127],"osv_alpine",[86],{"url":130,"sources":131,"tags":132},"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66199.json",[82,83],[86],{"url":134,"sources":135,"tags":136},"https://nvd.nist.gov/vuln/detail/CVE-2025-66199",[82,83],[86],[],{"date":139,"score":71,"percentile":140},"2026-09-19",0.35787,[142,146,149,153,156,159,163,167,170,173,176,179,181,184,187,190,193,196,199,202,205,208,210,213,216,219,222,225,227,230,233,236,240,243,246,249,252,255,257,260,263,266,269,272,275,278,281,284,287,290,293,296,298,301,304,307,310,313,316,319,322,325,328,331,334,337,340,343,347,350,353,356,359,362,365,368,371,374,377,380,383,386,389,392,395,398,401,404,407,410],{"date":143,"score":144,"percentile":145},"2026-01-28",0.00019,0.03906,{"date":147,"score":144,"percentile":148},"2026-01-29",0.03922,{"date":150,"score":151,"percentile":152},"2026-01-30",0.00046,0.13905,{"date":154,"score":151,"percentile":155},"2026-01-31",0.13916,{"date":157,"score":151,"percentile":158},"2026-02-01",0.13927,{"date":160,"score":161,"percentile":162},"2026-02-02",0.0006,0.18825,{"date":164,"score":165,"percentile":166},"2026-02-03",0.00059,0.18385,{"date":168,"score":165,"percentile":169},"2026-02-04",0.18371,{"date":171,"score":165,"percentile":172},"2026-02-05",0.18401,{"date":174,"score":165,"percentile":175},"2026-02-06",0.18419,{"date":177,"score":165,"percentile":178},"2026-02-07",0.18428,{"date":180,"score":165,"percentile":166},"2026-02-08",{"date":182,"score":165,"percentile":183},"2026-02-09",0.18339,{"date":185,"score":165,"percentile":186},"2026-02-10",0.18269,{"date":188,"score":165,"percentile":189},"2026-02-11",0.18279,{"date":191,"score":165,"percentile":192},"2026-02-12",0.1832,{"date":194,"score":165,"percentile":195},"2026-02-13",0.18323,{"date":197,"score":165,"percentile":198},"2026-02-14",0.1829,{"date":200,"score":165,"percentile":201},"2026-02-15",0.18273,{"date":203,"score":165,"percentile":204},"2026-02-16",0.18237,{"date":206,"score":165,"percentile":207},"2026-02-17",0.18223,{"date":209,"score":165,"percentile":169},"2026-02-18",{"date":211,"score":165,"percentile":212},"2026-02-19",0.18436,{"date":214,"score":165,"percentile":215},"2026-02-20",0.18441,{"date":217,"score":165,"percentile":218},"2026-02-21",0.18469,{"date":220,"score":165,"percentile":221},"2026-02-22",0.1847,{"date":223,"score":165,"percentile":224},"2026-02-23",0.18433,{"date":226,"score":165,"percentile":166},"2026-02-24",{"date":228,"score":165,"percentile":229},"2026-02-25",0.18354,{"date":231,"score":165,"percentile":232},"2026-02-26",0.18331,{"date":234,"score":165,"percentile":235},"2026-02-27",0.18347,{"date":237,"score":238,"percentile":239},"2026-02-28",0.00064,0.19898,{"date":241,"score":238,"percentile":242},"2026-03-01",0.19934,{"date":244,"score":238,"percentile":245},"2026-03-02",0.19885,{"date":247,"score":238,"percentile":248},"2026-03-03",0.19848,{"date":250,"score":238,"percentile":251},"2026-03-04",0.1976,{"date":253,"score":238,"percentile":254},"2026-03-05",0.19837,{"date":256,"score":238,"percentile":254},"2026-03-06",{"date":258,"score":238,"percentile":259},"2026-03-07",0.19828,{"date":261,"score":238,"percentile":262},"2026-03-08",0.19791,{"date":264,"score":238,"percentile":265},"2026-03-09",0.19756,{"date":267,"score":238,"percentile":268},"2026-03-10",0.1974,{"date":270,"score":238,"percentile":271},"2026-03-11",0.19727,{"date":273,"score":238,"percentile":274},"2026-03-12",0.19775,{"date":276,"score":238,"percentile":277},"2026-03-13",0.19815,{"date":279,"score":238,"percentile":280},"2026-03-14",0.1982,{"date":282,"score":238,"percentile":283},"2026-03-15",0.1975,{"date":285,"score":238,"percentile":286},"2026-03-16",0.19722,{"date":288,"score":238,"percentile":289},"2026-03-17",0.19685,{"date":291,"score":238,"percentile":292},"2026-03-18",0.19672,{"date":294,"score":238,"percentile":295},"2026-03-19",0.19671,{"date":297,"score":238,"percentile":271},"2026-03-20",{"date":299,"score":238,"percentile":300},"2026-03-21",0.19841,{"date":302,"score":238,"percentile":303},"2026-03-22",0.19834,{"date":305,"score":238,"percentile":306},"2026-03-23",0.19801,{"date":308,"score":238,"percentile":309},"2026-03-24",0.1979,{"date":311,"score":238,"percentile":312},"2026-03-25",0.19854,{"date":314,"score":238,"percentile":315},"2026-03-26",0.19931,{"date":317,"score":238,"percentile":318},"2026-03-27",0.19953,{"date":320,"score":238,"percentile":321},"2026-03-28",0.19978,{"date":323,"score":238,"percentile":324},"2026-03-29",0.19946,{"date":326,"score":238,"percentile":327},"2026-03-30",0.1993,{"date":329,"score":238,"percentile":330},"2026-03-31",0.19935,{"date":332,"score":238,"percentile":333},"2026-04-01",0.1996,{"date":335,"score":238,"percentile":336},"2026-04-02",0.20107,{"date":338,"score":238,"percentile":339},"2026-04-03",0.20135,{"date":341,"score":238,"percentile":342},"2026-04-04",0.20166,{"date":344,"score":345,"percentile":346},"2026-04-05",0.00067,0.20901,{"date":348,"score":345,"percentile":349},"2026-04-06",0.20661,{"date":351,"score":345,"percentile":352},"2026-04-07",0.20649,{"date":354,"score":345,"percentile":355},"2026-04-08",0.20726,{"date":357,"score":345,"percentile":358},"2026-04-09",0.20786,{"date":360,"score":345,"percentile":361},"2026-04-10",0.20808,{"date":363,"score":345,"percentile":364},"2026-04-11",0.20804,{"date":366,"score":345,"percentile":367},"2026-04-12",0.20762,{"date":369,"score":345,"percentile":370},"2026-04-13",0.2071,{"date":372,"score":345,"percentile":373},"2026-04-14",0.20669,{"date":375,"score":345,"percentile":376},"2026-04-15",0.20716,{"date":378,"score":345,"percentile":379},"2026-04-16",0.207,{"date":381,"score":345,"percentile":382},"2026-04-17",0.20702,{"date":384,"score":345,"percentile":385},"2026-04-18",0.20696,{"date":387,"score":345,"percentile":388},"2026-04-19",0.20635,{"date":390,"score":345,"percentile":391},"2026-04-20",0.20608,{"date":393,"score":345,"percentile":394},"2026-04-21",0.20688,{"date":396,"score":345,"percentile":397},"2026-04-22",0.20743,{"date":399,"score":345,"percentile":400},"2026-04-23",0.20757,{"date":402,"score":345,"percentile":403},"2026-04-24",0.20575,{"date":405,"score":345,"percentile":406},"2026-04-25",0.20589,{"date":408,"score":345,"percentile":409},"2026-04-26",0.20571,{"date":411,"score":345,"percentile":412},"2026-04-27",0.20567,[414,419,421,423,425,427,429],{"source":75,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":415,"cvss_v4_0":9},{"baseScore":73,"baseSeverity":416,"vectorString":76,"impactScore":417,"exploitabilityScore":418},"MEDIUM",6,5.6,{"source":81,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":420,"cvss_v4_0":9},{"baseScore":73,"baseSeverity":416,"vectorString":76,"impactScore":417,"exploitabilityScore":418},{"source":108,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":422,"cvss_v4_0":9},{"baseScore":73,"baseSeverity":9,"vectorString":76,"impactScore":417,"exploitabilityScore":418},{"source":113,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":424,"cvss_v4_0":9},{"baseScore":73,"baseSeverity":9,"vectorString":76,"impactScore":417,"exploitabilityScore":418},{"source":127,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":426,"cvss_v4_0":9},{"baseScore":73,"baseSeverity":9,"vectorString":76,"impactScore":417,"exploitabilityScore":418},{"source":82,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":428,"cvss_v4_0":9},{"baseScore":73,"baseSeverity":9,"vectorString":76,"impactScore":417,"exploitabilityScore":418},{"source":83,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":430,"cvss_v4_0":9},{"baseScore":73,"baseSeverity":9,"vectorString":76,"impactScore":417,"exploitabilityScore":418},[432,452,460,463,469,473,478,489,498,502,506,514],{"ecosystem":433,"name":434,"vendor":435,"product":434,"cpe_part":9,"purl_type":436,"purl_namespace":435,"purl_name":434,"source":9,"versions":437},"Alpine Linux","openssl","alpine","apk",[438,446,447,450,451],{"version":439,"is_range":440,"range_type":441,"version_start":442,"version_start_type":443,"version_end":444,"version_end_type":445,"fixed_in":9},"gte3_3_0_lt3_3_6_r0",true,"ecosystem","3.3.0","including","3.3.6-r0","excluding",{"version":439,"is_range":440,"range_type":441,"version_start":442,"version_start_type":443,"version_end":444,"version_end_type":445,"fixed_in":9},{"version":448,"is_range":440,"range_type":441,"version_start":442,"version_start_type":443,"version_end":449,"version_end_type":445,"fixed_in":9},"gte3_3_0_lt3_5_5_r0","3.5.5-r0",{"version":448,"is_range":440,"range_type":441,"version_start":442,"version_start_type":443,"version_end":449,"version_end_type":445,"fixed_in":9},{"version":448,"is_range":440,"range_type":441,"version_start":442,"version_start_type":443,"version_end":449,"version_end_type":445,"fixed_in":9},{"ecosystem":453,"name":454,"vendor":455,"product":454,"cpe_part":9,"purl_type":436,"purl_namespace":455,"purl_name":454,"source":9,"versions":456},"Chainguard","libcrypto3-2.34","chainguard",[457],{"version":458,"is_range":440,"range_type":441,"version_start":9,"version_start_type":9,"version_end":459,"version_end_type":445,"fixed_in":9},"lt3_6_1_r0","3.6.1-r0",{"ecosystem":453,"name":434,"vendor":455,"product":434,"cpe_part":9,"purl_type":436,"purl_namespace":455,"purl_name":434,"source":9,"versions":461},[462],{"version":458,"is_range":440,"range_type":441,"version_start":9,"version_start_type":9,"version_end":459,"version_end_type":445,"fixed_in":9},{"ecosystem":453,"name":464,"vendor":455,"product":464,"cpe_part":9,"purl_type":436,"purl_namespace":455,"purl_name":464,"source":9,"versions":465},"openssl-provider-fips-3.4.0",[466],{"version":467,"is_range":440,"range_type":441,"version_start":9,"version_start_type":9,"version_end":468,"version_end_type":445,"fixed_in":9},"lt0","0",{"ecosystem":453,"name":470,"vendor":455,"product":470,"cpe_part":9,"purl_type":436,"purl_namespace":455,"purl_name":470,"source":9,"versions":471},"openssl-provider-fips-3.6.0",[472],{"version":467,"is_range":440,"range_type":441,"version_start":9,"version_start_type":9,"version_end":468,"version_end_type":445,"fixed_in":9},{"ecosystem":474,"name":434,"vendor":475,"product":434,"cpe_part":9,"purl_type":436,"purl_namespace":475,"purl_name":434,"source":9,"versions":476},"Wolfi","wolfi",[477],{"version":458,"is_range":440,"range_type":441,"version_start":9,"version_start_type":9,"version_end":459,"version_end_type":445,"fixed_in":9},{"ecosystem":479,"name":434,"vendor":480,"product":434,"cpe_part":9,"purl_type":481,"purl_namespace":480,"purl_name":434,"source":9,"versions":482},"Debian","debian","deb",[483,486],{"version":484,"is_range":440,"range_type":441,"version_start":9,"version_start_type":9,"version_end":485,"version_end_type":445,"fixed_in":9},"lt3_5_4_1~deb13u2","3.5.4-1~deb13u2",{"version":487,"is_range":440,"range_type":441,"version_start":9,"version_start_type":9,"version_end":488,"version_end_type":445,"fixed_in":9},"lt3_5_5_1","3.5.5-1",{"ecosystem":490,"name":491,"vendor":492,"product":491,"cpe_part":9,"purl_type":481,"purl_namespace":492,"purl_name":491,"source":9,"versions":493},"Ubuntu","edk2","ubuntu",[494,496,497],{"version":495,"is_range":440,"range_type":441,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",{"version":495,"is_range":440,"range_type":441,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":495,"is_range":440,"range_type":441,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":490,"name":499,"vendor":492,"product":499,"cpe_part":9,"purl_type":481,"purl_namespace":492,"purl_name":499,"source":9,"versions":500},"edk2-hwe",[501],{"version":495,"is_range":440,"range_type":441,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":490,"name":503,"vendor":492,"product":503,"cpe_part":9,"purl_type":481,"purl_namespace":492,"purl_name":503,"source":9,"versions":504},"nodejs",[505],{"version":495,"is_range":440,"range_type":441,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":490,"name":434,"vendor":492,"product":434,"cpe_part":9,"purl_type":481,"purl_namespace":492,"purl_name":434,"source":9,"versions":507},[508,511],{"version":509,"is_range":440,"range_type":441,"version_start":9,"version_start_type":9,"version_end":510,"version_end_type":445,"fixed_in":9},"lt3_5_3_1ubuntu3","3.5.3-1ubuntu3",{"version":512,"is_range":440,"range_type":441,"version_start":9,"version_start_type":9,"version_end":513,"version_end_type":445,"fixed_in":9},"lt3_5_5_1ubuntu1","3.5.5-1ubuntu1",{"ecosystem":9,"name":515,"vendor":434,"product":434,"cpe_part":516,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":517},"OpenSSL","a",[518,522,526,530],{"version":519,"is_range":440,"range_type":520,"version_start":442,"version_start_type":443,"version_end":521,"version_end_type":445,"fixed_in":9},">= 3.3.0, \u003C 3.3.6","cpe","3.3.6",{"version":523,"is_range":440,"range_type":520,"version_start":524,"version_start_type":443,"version_end":525,"version_end_type":445,"fixed_in":9},">= 3.4.0, \u003C 3.4.4","3.4.0","3.4.4",{"version":527,"is_range":440,"range_type":520,"version_start":528,"version_start_type":443,"version_end":529,"version_end_type":445,"fixed_in":9},">= 3.5.0, \u003C 3.5.5","3.5.0","3.5.5",{"version":531,"is_range":440,"range_type":520,"version_start":532,"version_start_type":443,"version_end":533,"version_end_type":445,"fixed_in":9},">= 3.6.0, \u003C 3.6.1","3.6.0","3.6.1"]