CVE-2025-52494
BaseFortify
Publication date: 2025-09-03
Last updated on: 2025-09-08
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| adacore | ada_web_server | to 26.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Adacore Ada Web Server (AWS) before version 25.2 is a denial-of-service (DoS) issue caused by improper handling of SSL handshakes during connection initialization. Specifically, when a client starts an HTTPS connection, the server performs the SSL handshake before assigning the connection to a processing slot but does not set a specific timeout for this handshake phase, relying instead on an effectively infinite default socket timeout. An attacker can exploit this by sending malformed TLS ClientHello messages with incorrect length values, causing the server to wait indefinitely for data that never arrives. This blocks the worker thread handling the connection. By opening many such connections, an attacker can exhaust all available worker threads, preventing the server from processing legitimate requests.
How can this vulnerability impact me? :
This vulnerability can impact you by causing a denial-of-service condition on the Adacore Ada Web Server. An attacker can exploit it to exhaust all worker threads by sending malformed TLS ClientHello messages, which blocks the server from handling new legitimate HTTPS requests. This results in service unavailability or degraded performance, potentially disrupting access to web services hosted on the affected server.