Executive Summary

This vulnerability in Adacore Ada Web Server (AWS) before version 25.2 is a denial-of-service (DoS) issue caused by improper handling of SSL handshakes during connection initialization. Specifically, when a client starts an HTTPS connection, the server performs the SSL handshake before assigning the connection to a processing slot but does not set a specific timeout for this handshake phase, relying instead on an effectively infinite default socket timeout. An attacker can exploit this by sending malformed TLS ClientHello messages with incorrect length values, causing the server to wait indefinitely for data that never arrives. This blocks the worker thread handling the connection. By opening many such connections, an attacker can exhaust all available worker threads, preventing the server from processing legitimate requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a denial-of-service condition on the Adacore Ada Web Server. An attacker can exploit it to exhaust all worker threads by sending malformed TLS ClientHello messages, which blocks the server from handling new legitimate HTTPS requests. This results in service unavailability or degraded performance, potentially disrupting access to web services hosted on the affected server.

Useful 0 Not Useful 0