CVE-2008-0226: yaSSL buffer overflows in handshake and input parsing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote, unauthenticated code execution with a very high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is documented in this record.

What it is

yaSSL 1.7.5 and earlier contains multiple buffer overflows in the ProcessOldClientHello function (handshake.cpp) and the "input_buffer& operator>>" routine (yassl_imp.cpp). The library is embedded in MySQL and other products, so the flaw exposes any service that negotiates TLS through yaSSL. Successful exploitation allows remote code execution on the affected process.

Impact

A remote attacker can corrupt memory and execute arbitrary code in the context of the service using yaSSL, potentially leading to full compromise of the database or application process. Availability, integrity and confidentiality are all affected per the CVSS vector.

Attack surface

Reachable over the network via crafted TLS handshake or input data sent to a yaSSL-enabled listener; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The exact protocol entry point depends on how the embedding product exposes yaSSL.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.916 probability, 0.998 percentile), indicating strong likelihood of exploitation activity. Reference tags are advisory and VDB entries only, with no public exploit tag supplied.

What to do

• Upgrade yaSSL to a version later than 1.7.5, or apply the vendor patch for the embedding product (MySQL, Apple, Debian, Ubuntu advisories are referenced).
• For MySQL, upgrade to the fixed release noted in the MySQL 5.1.23 changelog and apply the corresponding distribution security update.
• If yaSSL cannot be patched immediately, restrict network access to TLS listeners to trusted sources and disable legacy/old client hello handling where configurable.
• Monitor vendor advisories for Apple, Debian, Ubuntu and Oracle for updated packages covering the embedded yaSSL library.
• Inventory all products that bundle yaSSL, since the flaw affects any application using the library, not only MySQL.

Detection

• Inspect TLS handshake traffic for malformed or oversized ClientHello messages targeting yaSSL-based services.
• Monitor service processes for crashes or abnormal restarts that could indicate memory corruption attempts.
• Correlate network connections to database or TLS ports with process crash logs and core dumps on hosts running yaSSL 1.7.5 or earlier.
• Use file and package inventory to identify hosts still running vulnerable yaSSL or unpatched MySQL builds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.