In Eclipse Californium versions 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without using a HelloVerifyRequest. Especially, if used with certificate based cipher suites, that results in message amplification (DDoS other peers) and high CPU load (DoS own peer). The misbehavior occurs only with DTLS_VERIFY_PEERS_ON_RESUMPTION_THRESHOLD values larger than 0.

Affected Packages

Maven org.eclipse.californium:californium-core

Affected versions: 2.0.0 (fixed in 2.7.3)

Maven org.eclipse.californium:californium-core

Affected versions: 3.0.0 (fixed in 3.6.0)

Related CVEs

CVE-2022-2576

Key Information

GHSA ID

GHSA-qq3j-44gw-cf6r

Published

July 30, 2022 12:00 AM

Last Modified

August 10, 2022 3:41 PM

CVSS Score

7.5 /10

Primary Ecosystem

Maven

Primary Package

org.eclipse.californium:californium-core

GitHub Reviewed

✓ Yes

Dataset

Last updated: November 25, 2025 6:29 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.