CVE-2024-2511

Deeper analysis

CVE-2024-2511 is a memory-management flaw in OpenSSL that affects TLS servers supporting TLSv1.3 when the non-default SSL_OP_NO_TICKET option is enabled without early-data anti-replay protection. Under certain conditions the session cache enters an incorrect state and stops flushing, producing unbounded memory growth that eventually results in a denial of service. The issue does not affect TLS clients, the FIPS modules in OpenSSL 3.0–3.2, or OpenSSL 1.0.2.

A remote attacker who can reach an affected server can deliberately trigger the cache-growth condition, exhausting memory and causing the server process to become unresponsive. Exploitation requires a specific non-default configuration and carries high attack complexity, consistent with the CVSS 5.9 rating that emphasizes availability impact without confidentiality or integrity loss.

The official OpenSSL advisory and accompanying commits (7e4d731, b52867a, e9d7083, and the extended-release fix) describe the root cause and provide patches that restore proper session-cache flushing. Administrators are advised to apply the updates or revert to default ticket behavior if the non-default option is not required.

EPSS scores have remained low and essentially flat (current 0.0883, peak 0.0905), indicating no material increase in observed exploitation interest since disclosure.