Description
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a `client-side TLS stack`, a peer can send a `HelloRetryRequest` followed by a `spoofed Hello message` that causes a null-pointer dereference. This can terminate the consuming process, including a process performing other work, resulting in denial of service. This issue is fixed in commit a06ca41.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
h2o picotls
< a06ca417a16f9126808bf5cabe6c5e6e0f16ecaeaffected