CVE-2020-25648

A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.

• CWE-770
• CWE-770

• https://bugzilla.redhat.com/show_bug.cgi?id=1887319Issue Tracking, Third Party Advisory
• https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.58_release_notesRelease Notes, Vendor Advisory
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2023/10/msg00039.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERA5SVJQXQMDGES7RIT4F4NQVLD35RXN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRM53IQCPZT2US3M7JXTP6I6IBA5RGOD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPOLN6DJUYQ3QBQEGLZGV73SNIPK7GHV/
• https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlNot Applicable, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1887319Issue Tracking, Third Party Advisory
• https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.58_release_notesRelease Notes, Vendor Advisory
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2023/10/msg00039.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERA5SVJQXQMDGES7RIT4F4NQVLD35RXN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRM53IQCPZT2US3M7JXTP6I6IBA5RGOD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPOLN6DJUYQ3QBQEGLZGV73SNIPK7GHV/
• https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlNot Applicable, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory

Published

Oct 20, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25641A flaw was found in the Linux kernel's implementation of bio…5.5
• CVE-2020-25643A flaw was found in the HDLC_PPP module of the Linux kernel …7.2
• CVE-2020-25644A memory leak flaw was found in WildFly OpenSSL in versions …7.5
• CVE-2020-25645A flaw was found in the Linux kernel in versions before 5.9-…7.5
• CVE-2020-25646A flaw was found in Ansible Collection community.crypto. ope…7.5
• CVE-2020-25647A flaw was found in grub2 in versions prior to 2.06. During …7.6
• CVE-2020-25649A flaw was found in FasterXML Jackson Databind, where it did…7.5
• CVE-2020-2565Vulnerability in the Oracle Solaris product of Oracle System…7.5
• CVE-2020-25650A flaw was found in the way the spice-vdagentd daemon handle…5.5
• CVE-2020-25651A flaw was found in the SPICE file transfer protocol. File d…6.4
• CVE-2020-25652A flaw was found in the spice-vdagentd daemon, where it did …5.5
• CVE-2020-25653A race condition vulnerability was found in the way the spic…6.3