The vulnerability, identified as CWE‑405 (Asymmetric Resource Consumption), occurs when a DTLS handshake is in progress and a peer sends a record for a future epoch. OpenSSL buffers the entire read buffer, which can be up to 16 KB, and may buffer up to 100 such records per connection, consuming around 1.7 MB of memory per association even though only a small amount of data is transmitted. This memory amplification can cause a denial of service by exhausting available memory on a DTLS server while maintaining an otherwise normal connection.

Vulnerable OpenSSL releases include 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2. Users should upgrade to OpenSSL 4.0.2, 3.6.4, 3.5.8, 3.4.7, or 3.0.22. Premium support customers should install OpenSSL 1.1.1zi or 1.0.2zr.

The CVSS assessment lists a score of 7.5, but the CVE description categorizes the vulnerability as low severity. The EPSS score is not available and the issue is not listed in CISA KEV, indicating a relatively low likelihood of exploitation in the current landscape. Based on the description, it is inferred that the attack vector is a network-based exploitation via UDP, requiring an attacker to send forged DTLS records belonging to a future epoch to a reachable DTLS endpoint. The exploitation complexity is moderate, but the attack has a low network footprint; an attacker can send a short burst of crafted packets to induce memory buffering that may exhaust available memory if a large number of concurrent DTLS associations are processed.