Loading vulnerability…
OpenSSL DTLS Anti-Replay Window Denial of Service
CVE-2016-2181 is a vulnerability in OpenSSL's DTLS replay-protection implementation that updates the replay window for future-epoch records before validating their message authentication codes. An attacker can submit a spoofed record for the next epoch with a very large sequence number, advancing the replay window so that subsequent legitimate records are incorrectly discarded. The malicious record need not decrypt successfully or have a valid MAC. The flaw affects vulnerable OpenSSL releases before 1.1.0, with fixes backported to 1.0.1u and 1.0.2i, and causes denial of service for a specific DTLS connection.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote unauthenticated attacker can disrupt an established DTLS connection by causing an OpenSSL-based server to reject subsequent legitimate client packets. The demonstrated impact is connection-level loss of availability; confidentiality loss, data modification, and code execution are not established.
If you can’t patch tonight, do this now.
Until patching is possible, restrict network access to affected DTLS services to trusted peers and disable unnecessary DTLS services. These measures reduce exposure but do not correct replay-window handling; no complete protocol-level workaround is established.
Patch, then assume compromise.
Upgrade to a supported OpenSSL release containing the fix, or install the applicable vendor-patched package. Historical upstream fixes are OpenSSL 1.0.1u and 1.0.2i; OpenSSL 1.1.0 is not affected. For RHEL 6 and 7, apply RHSA-2016:1940 or a superseding update. Restart all services linked against the updated OpenSSL library, or reboot, to activate the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.