CVE-2025-52494
Description
A flaw was found in AdaCore Web Server (AWS) where the server does not enforce a timeout during the SSL handshake when clients connect over HTTPS. Attackers can exploit this by sending specially crafted handshake messages that never complete, tying up the server's worker threads and preventing it from serving legitimate requests, resulting in a denial of service.
Statement
This vulnerability occurs because AWS performs the SSL handshake before assigning the connection to a processing slot and relies on the default socket timeout which is effectively infinite. This is a problem because a crafted message with incorrect length values can cause the SSL handshake to block indefinitely, leaving the worker thread stuck in the pre-slot state. If many such connections are opened, the worker threads on AWS could all be exhausted which would deny the AWS to other legitimate clients that want to connect to the server.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
