# CVE-2022-2576: californium-core DoS — Fixed in 2.7.3 ☕ ☕ Maven Not in CISA KEV HIGH severity # CVE-2022-2576 — californium-core HIGH [Fix: eclipse-californium/californium#2039](https://github.com/eclipse-californium/californium/pull/2039) CVE-2022-2576 is a high-severity (CVSS 7.5) CWE-408 vulnerability in org.eclipse.californium:californium-core. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for org.eclipse.californium:californium-core — see the affected versions and patch details below. Eclipse Californium denial of service (DoS) via Datagram Transport Layer Security (DTLS) handshake on parameter mismatch Also known as[GHSA-qq3j-44gw-cf6r](/vulnerability/GHSA-qq3j-44gw-cf6r) Published Jul 29, 2022 Updated Oct 28, 2026 Affected 2 pkgs Patched 2 / 2 Exploits 1 known Exploitation data as of Nov 5, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.6%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs49th percentile — riskier than 49% of all scored CVEsHighest risk 0.00%0.37%0.74%1.11%0.2%0.6%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 2 pkgs affected ☕`org.eclipse.californium:californium-core`☕`org.eclipse.californium:californium-core` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems. ## Description In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without using a HelloVerifyRequest. Especially, if used with certificate based cipher suites, that results in message amplification (DDoS other peers) and high CPU load (DoS own peer). The misbehavior occurs only with DTLS\_VERIFY\_PEERS\_ON\_RESUMPTION\_THRESHOLD values larger than 0. ## Affected Packages 2 total 2 fixed Ecosystem Package Vulnerable range Fix ☕Maven `org.eclipse.californium:californium-core` ≥ 2.0.0&&< 2.7.3 2.7.3`org.eclipse.californium:californium-core:2.7.3` ☕Maven `org.eclipse.californium:californium-core` ≥ 3.0.0&&< 3.6.0 3.6.0`org.eclipse.californium:californium-core:3.6.0` ## Affected Products 1 product · 2 configurations Application `californium`eclipse ≥ 3.0.0 && ≤ 3.5.0 range Exploits & PoCs 1 Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization. [ In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS res… bugs.eclipse.orgNVDAug 2022 ](https://bugs.eclipse.org/580018) ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.eclipse.californium:californium-core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update org.eclipse.californium:californium-core to 2.7.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-2576 is resolved across your whole dependency graph. 3. ### Workarounds Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service. ## Frequently Asked Questions In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without using a HelloVerifyRequest. Especially, if used with certificate based cipher suites, that results in message amplification (DDoS other peers) and high CPU load (DoS own peer). The misbehavior occurs only with DTLS\_VERIFY\_PEERS\_ON\_RESUMPTION\_THRESHOLD values larger than 0. O3 Security · Impact-Aware SCA ### Is CVE-2022-2576 in your dependencies? Find it across Maven, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)