CVE-2025-52494

Adacore Ada Web Server (AWS) before 25.2 is vulnerable to a denial-of-service (DoS) condition due to improper handling of SSL handshakes during connection initialization. When a client initiates an HTTPS connection, the server performs the SSL handshake before assigning the connection to a processing slot. However, there is no specific timeout set for this phase, and the server uses the default socket timeout, which is effectively infinite. An attacker can exploit this by sending a malformed TLS ClientHello message with incorrect length values. This causes the server to wait indefinitely for data that never arrives, blocking the worker thread (Line) handling the connection. By opening multiple such connections, up to the server's maximum limit, the attacker can exhaust all available working threads, preventing the server from handling new, legitimate requests.

• CWE-400
• CWE-770

• https://adacore.comProduct
• https://docs.adacore.com/corp/security-advisories/SEC.AWS-0095-v1.pdfTechnical Description, Vendor Advisory

Published

Sep 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-52488DNN (formerly DotNetNuke) is an open-source web content mana…8.6
• CVE-2025-5249A vulnerability has been found in PHPGurukul News Portal Pro…9.8
• CVE-2025-52490An issue was discovered in Couchbase Sync Gateway before 3.2…7.3
• CVE-2025-52491Akamai CloudTest before 60 2025.06.09 (12989) allows SSRF.5.8
• CVE-2025-52492A vulnerability has been discovered in the firmware of Paxto…7.5
• CVE-2025-52493PagerDuty Runbook through 2025-06-12 exposes stored secrets …6.5
• CVE-2025-52496Mbed TLS before 3.6.4 has a race condition in AESNI detectio…7.8
• CVE-2025-52497Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based …4.8
• CVE-2025-5250A vulnerability was found in PHPGurukul News Portal Project …9.8
• CVE-2025-5251A vulnerability was found in PHPGurukul News Portal Project …9.8
• CVE-2025-52512An issue was discovered in Samsung Mobile Processor Exynos 2…7.5
• CVE-2025-52513An issue was discovered in Samsung Mobile Processor Exynos 2…7.5