CVE-2014-2899
wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer...
wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchange message when the ephemeral key is not found.
Exploit likelihood
What each source reports
NVD Score used
wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchange message when the ephemeral key is not found.
- Record
CVE-2014-2899- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchange message when the ephemeral key is not found.
- Record
CVE-2014-2899- Updated
- 2026-11-02
EUVDEUVD-2014-2922 No score
wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchange message when the ephemeral key is not found.
- Record
EUVD-2014-2922- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qc4v-fv24-r267 No score
wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer...
wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchange message when the ephemeral key is not found.
- Record
GHSA-qc4v-fv24-r267- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-2899 is a medium vulnerability (CVSS 5.0) in Yassl Cyassl, published April 22, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.82%, the 78th percentile. No source names a fixed version.
References
wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html
security.gentoo.org/glsa/201612-53
seclists.org/oss-sec/2014/q2/126
securityfocus.com/bid/66780
secunia.com/advisories/57743
nvd.nist.gov/vuln/detail/CVE-2014-2899
github.com/advisories/GHSA-qc4v-fv24-r267