CVE-2024-2511
MediumIssue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that woul
Published Apr 8, 2024 · Updated Oct 16, 2026 · Also known as ALPINE-CVE-2024-2511, DEBIAN-CVE-2024-2511, EUVD-2024-27460, GHSA-299c-jvhc-gxj8, JLSEC-2026-249, SUSE-SU-2024:1633-1, SUSE-SU-2024:1634-1, SUSE-SU-2024:1808-1, SUSE-SU-2024:1947-1, SUSE-SU-2024:1949-1, SUSE-SU-2024:2953-1, UBUNTU-CVE-2024-2511, USN-6937-1
Key Facts
Patch immediately- CVE-2024-2511 is a medium-severity vulnerability (CVSS 5.9 v3.1) affecting OpenSSL (alpine), rootio-openssl, seal-openssl and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 52% probability of exploitation in the next 30 days.
- Fixed versions are available, including cloud-hypervisor-cvm 38.0.72.2-1, edk2 2022.02-3ubuntu0.22.04.4, edk2 2024.02-2ubuntu0.6.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
52%
Higher than 98.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2024-2511 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions
Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation.
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients.
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.
Affected Products
379 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| OpenSSLalpine | >= 3.2.0 | 3.0.12-r5 |
| rootio-opensslrootio | See advisory | 3.1.4-r6 |
| seal-opensslseal | See advisory | 1.1.1w-0+deb11u2+sp999 |
| edk2ubuntu | See advisory | 2022.02-3ubuntu0.22.04.4 |
| efi-shell-aa64ubuntu | See advisory | 2024.02-2ubuntu0.6 |
Patched Releases
cloud-hypervisor-cvm
38.0.72.2-1
edk2
2022.02-3ubuntu0.22.04.4, 2024.02-2ubuntu0.6, 20240524git3e722403cd16-8, 2025.02-3ubuntu2.2
edk2-aarch64
20200801stable-1.amzn2.0.6
edk2-ovmf
20200801stable-1.amzn2.0.6
edk2-tools
20200801stable-1.amzn2.0.6
edk2-tools-doc
20200801stable-1.amzn2.0.6
edk2-tools-python
20200801stable-1.amzn2.0.6
efi-shell-aa64
2024.02-2ubuntu0.6, 2025.02-3ubuntu2.2
efi-shell-arm
2024.02-2ubuntu0.6, 2025.02-3ubuntu2.2
efi-shell-ia32
2024.02-2ubuntu0.6, 2025.02-3ubuntu2.2
efi-shell-loongarch64
2025.02-3ubuntu2.2
efi-shell-riscv64
2024.02-2ubuntu0.6, 2025.02-3ubuntu2.2
efi-shell-x64
2024.02-2ubuntu0.6, 2025.02-3ubuntu2.2
hvloader
1.0.1-6
jitterentropy-devel
3.4.1-3.1
libjitterentropy3
3.4.1-3.1
libopenssl-1_1-devel
1.1.1d-150200.11.88.1, 1.1.1d-2.110.2, 1.1.1l-150400.7.66.2, 1.1.1l-150500.17.28.2, 1.1.1w-9.1
libopenssl-1_1-devel-32bit
1.1.1d-150200.11.88.1, 1.1.1d-2.110.2, 1.1.1l-150400.7.66.2, 1.1.1l-150500.17.28.2, 1.1.1w-9.1
libopenssl-3-devel
3.0.8-150400.4.54.1, 3.0.8-150500.5.30.1, 3.1.4-6.1
libopenssl-3-devel-32bit
3.0.8-150500.5.30.1, 3.1.4-6.1
libopenssl-3-fips-provider
3.1.4-6.1
libopenssl-3-fips-provider-32bit
3.1.4-6.1
libopenssl-3-fips-provider-x86-64-v3
3.1.4-6.1
libopenssl1_1
1.1.1d-150200.11.88.1, 1.1.1d-2.110.2, 1.1.1l-150400.7.66.2, 1.1.1l-150500.17.28.2, 1.1.1w-9.1
libopenssl1_1-32bit
1.1.1d-150200.11.88.1, 1.1.1d-2.110.2, 1.1.1l-150400.7.66.2, 1.1.1l-150500.17.28.2, 1.1.1w-9.1
Timeline
Publicly disclosed
Apr 8, 2024
Last updated
Oct 16, 2026
Weakness Type
- CWE-400 Uncontrolled Resource Consumption
- CWE-1325 Improperly Controlled Sequential Memory Allocation
References
- advisoryRHSA-2024:9333
- advisoryhttps://bugzilla.suse.com/1222548
- advisoryhttps://bugzilla.suse.com/1224388
- advisoryhttps://bugzilla.suse.com/1227138
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2511.json
FAQ
Common Questions.
Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-def…
Affected: OpenSSL (alpine) versions >= 3.2.0; rootio-openssl; seal-openssl, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including cloud-hypervisor-cvm 38.0.72.2-1, edk2 2022.02-3ubuntu0.22.04.4, edk2 2024.02-2ubuntu0.6.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2024-2511 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo