CVE-2016-6302

HIGH · CVSS 7.5 EPSS 26.44%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2016-09-16 · Last synced 2026-08-04

Field Assessment

AI analysis pending.

CVE

CVE-2016-6302

Severity

HIGH

CVSS

7.5

EPSS

26.44%

OpenSSL

Original Filing — NVD Description

The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.