Vulnerability record · CVE-2015-0206 · published 9 January 2015
CVE-2015-0206: OpenSSL DTLS duplicate record memory leak denial of service
OOpenssl · Openssl
OpenSSL's dtls1_buffer_record in d1_pkt.c leaks memory when a remote peer sends many duplicate records for the next epoch, eventually exhausting memory and breaking replay detection. It affects OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k. The flaw matters because it lets an unauthenticated network peer degrade or crash DTLS services over time.
Description
Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
medium priorityThe flaw is remotely reachable without authentication and has high EPSS, but it only causes denial of service and is not known to be actively exploited.
What it is
OpenSSL's dtls1_buffer_record in d1_pkt.c leaks memory when a remote peer sends many duplicate records for the next epoch, eventually exhausting memory and breaking replay detection. It affects OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k. The flaw matters because it lets an unauthenticated network peer degrade or crash DTLS services over time.
Impact
An attacker can consume process memory until the DTLS service fails or becomes unavailable, causing a denial of service. No confidentiality or integrity impact is described.
Attack surface
Reachable remotely over the network via DTLS traffic; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The attack requires sending crafted duplicate records for the next epoch.
Exploitation
Not listed in CISA KEV and no reference is tagged as exploit code, but EPSS is high at 0.5736 (99th percentile), suggesting elevated likelihood of attempted exploitation. No public exploit details are provided in the record.
What to do
- Upgrade OpenSSL to 1.0.0p or 1.0.1k or later, or apply the vendor patch for your distribution.
- Where DTLS is not required, disable DTLS listeners to remove the exposure.
- Apply vendor advisories for Red Hat, Debian, SUSE, Oracle and Cisco products that bundle the affected OpenSSL versions.
- Rate-limit or filter DTLS traffic from untrusted networks and monitor memory growth on DTLS endpoints.
Detection
- Monitor DTLS server processes for sustained memory growth or OOM events without matching legitimate traffic increases.
- Alert on high volumes of duplicate DTLS records for the next epoch from a single source.
- Track OpenSSL versions in use and flag hosts still running 1.0.0 before 1.0.0p or 1.0.1 before 1.0.1k.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-0206 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-0206), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
