Description
During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL 1.1.0 before 1.1.0e to crash (dependent on ciphersuite). Both clients and servers are affected.
Remediation
References
Related Vulnerabilities
WordPress Plugin Twitter Button by BestWebSoft Cross-Site Scripting (2.54)
WordPress CVE-2016-5839 Vulnerability (CVE-2016-5839)
Lodash CVE-2018-16487 Vulnerability (CVE-2018-16487)
Django Incorrect Default Permissions Vulnerability (CVE-2020-24583)
MyBB Exposure of Sensitive Information Through Metadata Vulnerability (CVE-2025-48941)