UBUNTU-CVE-2025-66199

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2025-66199
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-66199.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2025-66199
Upstream
Downstream
Related
Published
2026-01-27T00:00:00Z
Modified
2026-02-03T08:33:24.877104Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - low
Summary
[none]
Details

Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit. Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service). In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate message is used to grow a heap buffer prior to decompression. This length is not bounded by the maxcertlist setting, which otherwise constrains certificate message sizes. An attacker can exploit this to cause large per-connection allocations followed by handshake failure. No memory corruption or information disclosure occurs. This issue only affects builds where TLS 1.3 certificate compression is compiled in (i.e., not OPENSSLNOCOMPALG) and at least one compression algorithm (brotli, zlib, or zstd) is available, and where the compression extension is negotiated. Both clients receiving a server CompressedCertificate and servers in mutual TLS scenarios receiving a client CompressedCertificate are affected. Servers that do not request client certificates are not vulnerable to client-initiated attacks. Users can mitigate this issue by setting SSLOPNORXCERTIFICATECOMPRESSION to disable receiving compressed certificates. The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the TLS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue. OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

References

Affected packages

Ubuntu:24.04:LTS

edk2

Package

Name
edk2
Purl
pkg:deb/ubuntu/edk2@2024.02-2ubuntu0.7?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2023.*

2023.05-2
2023.11-2
2023.11-3
2023.11-4
2023.11-5
2023.11-6
2023.11-8

2024.*

2024.02-1
2024.02-2
2024.02-2ubuntu0.1
2024.02-2ubuntu0.3
2024.02-2ubuntu0.4
2024.02-2ubuntu0.5
2024.02-2ubuntu0.6
2024.02-2ubuntu0.7

Ecosystem specific 

{
    "priority_reason": "OpenSSL developers have rated this issue to be low severity",
    "binaries": [
        {
            "binary_name": "efi-shell-aa64",
            "binary_version": "2024.02-2ubuntu0.7"
        },
        {
            "binary_name": "efi-shell-arm",
            "binary_version": "2024.02-2ubuntu0.7"
        },
        {
            "binary_name": "efi-shell-ia32",
            "binary_version": "2024.02-2ubuntu0.7"
        },
        {
            "binary_name": "efi-shell-riscv64",
            "binary_version": "2024.02-2ubuntu0.7"
        },
        {
            "binary_name": "efi-shell-x64",
            "binary_version": "2024.02-2ubuntu0.7"
        },
        {
            "binary_name": "ovmf",
            "binary_version": "2024.02-2ubuntu0.7"
        },
        {
            "binary_name": "ovmf-ia32",
            "binary_version": "2024.02-2ubuntu0.7"
        },
        {
            "binary_name": "qemu-efi-aarch64",
            "binary_version": "2024.02-2ubuntu0.7"
        },
        {
            "binary_name": "qemu-efi-arm",
            "binary_version": "2024.02-2ubuntu0.7"
        },
        {
            "binary_name": "qemu-efi-riscv64",
            "binary_version": "2024.02-2ubuntu0.7"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-66199.json"

Ubuntu:25.10

edk2

Package

Name
edk2
Purl
pkg:deb/ubuntu/edk2@2025.02-8ubuntu3?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2025.*

2025.02-3ubuntu2
2025.02-8
2025.02-8ubuntu1
2025.02-8ubuntu2
2025.02-8ubuntu3

Ecosystem specific 

{
    "priority_reason": "OpenSSL developers have rated this issue to be low severity",
    "binaries": [
        {
            "binary_name": "efi-shell-aa64",
            "binary_version": "2025.02-8ubuntu3"
        },
        {
            "binary_name": "efi-shell-arm",
            "binary_version": "2025.02-8ubuntu3"
        },
        {
            "binary_name": "efi-shell-ia32",
            "binary_version": "2025.02-8ubuntu3"
        },
        {
            "binary_name": "efi-shell-loongarch64",
            "binary_version": "2025.02-8ubuntu3"
        },
        {
            "binary_name": "efi-shell-riscv64",
            "binary_version": "2025.02-8ubuntu3"
        },
        {
            "binary_name": "efi-shell-x64",
            "binary_version": "2025.02-8ubuntu3"
        },
        {
            "binary_name": "ovmf",
            "binary_version": "2025.02-8ubuntu3"
        },
        {
            "binary_name": "ovmf-ia32",
            "binary_version": "2025.02-8ubuntu3"
        },
        {
            "binary_name": "ovmf-inteltdx",
            "binary_version": "2025.02-8ubuntu3"
        },
        {
            "binary_name": "qemu-efi-aarch64",
            "binary_version": "2025.02-8ubuntu3"
        },
        {
            "binary_name": "qemu-efi-arm",
            "binary_version": "2025.02-8ubuntu3"
        },
        {
            "binary_name": "qemu-efi-loongarch64",
            "binary_version": "2025.02-8ubuntu3"
        },
        {
            "binary_name": "qemu-efi-riscv64",
            "binary_version": "2025.02-8ubuntu3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-66199.json"

openssl

Package

Name
openssl
Purl
pkg:deb/ubuntu/openssl@3.5.3-1ubuntu3?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.5.3-1ubuntu3

Affected versions

3.*

3.4.1-1ubuntu3
3.5.0-2ubuntu1
3.5.2-1ubuntu1
3.5.3-1ubuntu2

Ecosystem specific 

{
    "priority_reason": "OpenSSL developers have rated this issue to be low severity",
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "libssl-dev",
            "binary_version": "3.5.3-1ubuntu3"
        },
        {
            "binary_name": "libssl3t64",
            "binary_version": "3.5.3-1ubuntu3"
        },
        {
            "binary_name": "openssl",
            "binary_version": "3.5.3-1ubuntu3"
        },
        {
            "binary_name": "openssl-provider-legacy",
            "binary_version": "3.5.3-1ubuntu3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-66199.json"

Ubuntu:Pro:16.04:LTS

nodejs

Package

Name
nodejs
Purl
pkg:deb/ubuntu/nodejs@4.2.6~dfsg-1ubuntu4.2+esm3?arch=source&distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.10.25~dfsg2-2ubuntu1

4.*

4.2.2~dfsg-1
4.2.3~dfsg-1
4.2.4~dfsg-1ubuntu1
4.2.4~dfsg-2
4.2.6~dfsg-1ubuntu1
4.2.6~dfsg-1ubuntu4
4.2.6~dfsg-1ubuntu4.1
4.2.6~dfsg-1ubuntu4.2
4.2.6~dfsg-1ubuntu4.2+esm1
4.2.6~dfsg-1ubuntu4.2+esm2
4.2.6~dfsg-1ubuntu4.2+esm3

Ecosystem specific 

{
    "priority_reason": "OpenSSL developers have rated this issue to be low severity",
    "binaries": [
        {
            "binary_name": "nodejs",
            "binary_version": "4.2.6~dfsg-1ubuntu4.2+esm3"
        },
        {
            "binary_name": "nodejs-dev",
            "binary_version": "4.2.6~dfsg-1ubuntu4.2+esm3"
        },
        {
            "binary_name": "nodejs-legacy",
            "binary_version": "4.2.6~dfsg-1ubuntu4.2+esm3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-66199.json"

Ubuntu:Pro:18.04:LTS

nodejs

Package

Name
nodejs
Purl
pkg:deb/ubuntu/nodejs@8.10.0~dfsg-2ubuntu0.4+esm6?arch=source&distro=esm-apps/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.11.4~dfsg-1ubuntu1
6.11.4~dfsg-1ubuntu2
6.12.0~dfsg-1ubuntu1
6.12.0~dfsg-2ubuntu1
6.12.0~dfsg-2ubuntu2

8.*

8.10.0~dfsg-2
8.10.0~dfsg-2ubuntu0.2
8.10.0~dfsg-2ubuntu0.3
8.10.0~dfsg-2ubuntu0.4
8.10.0~dfsg-2ubuntu0.4+esm1
8.10.0~dfsg-2ubuntu0.4+esm2
8.10.0~dfsg-2ubuntu0.4+esm3
8.10.0~dfsg-2ubuntu0.4+esm4
8.10.0~dfsg-2ubuntu0.4+esm5
8.10.0~dfsg-2ubuntu0.4+esm6

Ecosystem specific 

{
    "priority_reason": "OpenSSL developers have rated this issue to be low severity",
    "binaries": [
        {
            "binary_name": "nodejs",
            "binary_version": "8.10.0~dfsg-2ubuntu0.4+esm6"
        },
        {
            "binary_name": "nodejs-dev",
            "binary_version": "8.10.0~dfsg-2ubuntu0.4+esm6"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-66199.json"

Ubuntu:Pro:22.04:LTS

nodejs

Package

Name
nodejs
Purl
pkg:deb/ubuntu/nodejs@12.22.9~dfsg-1ubuntu3.6+esm2?arch=source&distro=esm-apps/jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

12.*

12.22.5~dfsg-5ubuntu1
12.22.7~dfsg-2ubuntu1
12.22.7~dfsg-2ubuntu3
12.22.9~dfsg-1ubuntu2
12.22.9~dfsg-1ubuntu3
12.22.9~dfsg-1ubuntu3.1
12.22.9~dfsg-1ubuntu3.2
12.22.9~dfsg-1ubuntu3.3
12.22.9~dfsg-1ubuntu3.4
12.22.9~dfsg-1ubuntu3.5
12.22.9~dfsg-1ubuntu3.6
12.22.9~dfsg-1ubuntu3.6+esm2

Ecosystem specific 

{
    "priority_reason": "OpenSSL developers have rated this issue to be low severity",
    "binaries": [
        {
            "binary_name": "libnode-dev",
            "binary_version": "12.22.9~dfsg-1ubuntu3.6+esm2"
        },
        {
            "binary_name": "libnode72",
            "binary_version": "12.22.9~dfsg-1ubuntu3.6+esm2"
        },
        {
            "binary_name": "nodejs",
            "binary_version": "12.22.9~dfsg-1ubuntu3.6+esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-66199.json"