The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in…

Description

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.

Scores

EPSS (exploitation in 30 days)

87.3% · top 0.2% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

• n/a
• CWE-300 Channel Accessible by Non-Endpoint (opens in a new tab)All about CWE-300 and its CVEs
• CWE-295 (opens in a new tab)All about CWE-295 and its CVEs

Affected products

• n/a

  • affected n/a

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.apache.tomcat:tomcatGHSA-f7w7-6pjc-wwm6 (opens in a new tab)

References (299)

• APPLE-SA-2010-05-18-1 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• 1023427 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• http://support.avaya.com/css/P8/documents/100081611 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 62210 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 37640 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www.arubanetworks.com/support/alerts/aid-020810.txt (opens in a new tab)x_refsource_CONFIRMx_transferred
• ADV-2010-0916 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• http://support.avaya.com/css/P8/documents/100114327 (opens in a new tab)x_refsource_CONFIRMx_transferred
• RHSA-2010:0167 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• ADV-2010-2010 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• FEDORA-2009-12750 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• ADV-2010-0086 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• ADV-2010-1673 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• [tls] 20091104 TLS renegotiation issue (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• 37656 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• RHSA-2010:0865 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• 39628 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 42724 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2009-3310 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• ADV-2009-3205 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• http://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_during (opens in a new tab)x_refsource_CONFIRMx_transferred
• 39461 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://support.avaya.com/css/P8/documents/100114315 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.proftpd.org/docs/RELEASE_NOTES-1.3.2c (opens in a new tab)x_refsource_CONFIRMx_transferred
• GLSA-201406-32 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• http://www.ingate.com/Relnote.php?ver=481 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 1023204 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• 40866 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• HPSBMU02799 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• TA10-222A (opens in a new tab)third-party-advisoryx_refsource_CERTx_transferred
• 1023211 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• SSRT090249 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 39317 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 1023212 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• SUSE-SA:2010:061 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• 39127 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 40545 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2010-3069 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• [4.5] 010: SECURITY FIX: November 26, 2009 (opens in a new tab)vendor-advisoryx_refsource_OPENBSDx_transferred
• 1023210 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• 1023270 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• 40070 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 1023273 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• http://kbase.redhat.com/faq/docs/DOC-20491 (opens in a new tab)x_refsource_CONFIRMx_transferred
• USN-927-5 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• PM12247 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
• SUSE-SU-2011:0847 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• MDVSA-2010:089 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• RHSA-2010:0770 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• http://www.openssl.org/news/secadv_20091111.txt (opens in a new tab)x_refsource_CONFIRMx_transferred
• 1023275 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• DSA-3253 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• ADV-2009-3484 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 1023207 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• 37859 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• SSRT101846 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 1021752 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
• FEDORA-2010-6131 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• ADV-2010-0848 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• [oss-security] 20091107 Re: [TLS] CVE-2009-3555 for TLS renegotiation MITM attacks (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• 39819 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• IC68055 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
• http://www.links.org/?p=786 (opens in a new tab)x_refsource_MISCx_transferred
• 60521 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• [oss-security] 20091123 Re: CVEs for nginx (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• VU#120541 (opens in a new tab)third-party-advisoryx_refsource_CERT-VNx_transferred
• 1023217 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• RHSA-2010:0768 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• ADV-2009-3353 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• FEDORA-2010-5357 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• 39136 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www.openoffice.org/security/cves/CVE-2009-3555.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• ADV-2011-0032 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 1023148 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• openSUSE-SU-2011:0845 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• 36935 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• http://www.tombom.co.uk/blog/?p=85 (opens in a new tab)x_refsource_MISCx_transferred
• SSRT090208 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• ADV-2010-1107 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 1023218 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• ADV-2010-1350 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• RHSA-2010:0338 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• 42379 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• FEDORA-2009-12775 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• 20091109 Transport Layer Security Renegotiation Vulnerability (opens in a new tab)vendor-advisoryx_refsource_CISCOx_transferred
• IC67848 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
• 1023213 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• FEDORA-2010-16240 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• ADV-2010-1793 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• oval:org.mitre.oval:def:11617 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• http://extendedsubset.com/?p=8 (opens in a new tab)x_refsource_MISCx_transferred
• 37292 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• SSRT100817 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• tls-renegotiation-weak-security(54158) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• APPLE-SA-2010-05-18-2 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• 39278 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 1023205 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• RHSA-2010:0130 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• http://tomcat.apache.org/native-doc/miscellaneous/changelog-1.1.x.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://support.apple.com/kb/HT4004 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 1023215 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• USN-1010-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• 1023206 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• SUSE-SR:2010:011 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888 (opens in a new tab)x_refsource_CONFIRMx_transferred
• GLSA-200912-01 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• SSRT090180 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• ADV-2009-3313 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 274990 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
• 1023208 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• 43308 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 1023214 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• SUSE-SA:2009:057 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• 38781 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• HPSBOV02762 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• DSA-1934 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• FEDORA-2009-12782 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• oval:org.mitre.oval:def:7478 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• 1023271 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• APPLE-SA-2010-01-19-1 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• [cryptography] 20091105 OpenSSL 0.9.8l released (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• 42467 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20091130 TLS / SSLv3 vulnerability explained (New ways to leverage the vulnerability) (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• oval:org.mitre.oval:def:7315 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• 1023224 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• SUSE-SR:2010:013 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• USN-927-4 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• 41490 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20091124 rPSA-2009-0155-1 httpd mod_ssl (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 1023243 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• http://blog.g-sec.lu/2009/11/tls-sslv3-renegotiation-vulnerability.html (opens in a new tab)x_refsource_MISCx_transferred
• 37504 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 1023219 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• http://sysoev.ru/nginx/patch.cve-2009-3555.txt (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html (opens in a new tab)x_refsource_MISCx_transferred
• 1023163 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• HPSBHF02706 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• ADV-2009-3521 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• oval:org.mitre.oval:def:7973 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• HPSBMA02568 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• http://support.zeus.com/zws/news/2010/01/13/zws_4_3r5_released (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://bugzilla.redhat.com/show_bug.cgi?id=533125 (opens in a new tab)x_refsource_CONFIRMx_transferred
• oval:org.mitre.oval:def:10088 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• 44183 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://support.zeus.com/zws/media/docs/4.3/RELEASE_NOTES (opens in a new tab)x_refsource_CONFIRMx_transferred
• 42808 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 39500 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• oval:org.mitre.oval:def:11578 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• ADV-2009-3220 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• SSRT100179 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• SSRT100089 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• RHSA-2010:0165 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• 20101207 VMSA-2010-0019 VMware ESX third party updates for Service Console (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• RHSA-2010:0987 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• https://bugzilla.mozilla.org/show_bug.cgi?id=545755 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21426108 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://blogs.iss.net/archive/sslmitmiscsrf.html (opens in a new tab)x_refsource_MISCx_transferred
• 1023411 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• RHSA-2010:0339 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2010:0986 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• ADV-2009-3164 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 37383 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• FEDORA-2009-12229 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• 44954 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• [tls] 20091104 MITM attack on delayed TLS-client auth through renegotiation (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• http://support.avaya.com/css/P8/documents/100070150 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 40747 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• HPSBUX02498 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 39292 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 42816 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• IC68054 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
• 273029 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
• FEDORA-2009-12604 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21432298 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://extendedsubset.com/Renegotiating_TLS.pdf (opens in a new tab)x_refsource_MISCx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg24025312 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg24006386 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://support.apple.com/kb/HT4170 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 20091118 TLS / SSLv3 vulnerability explained (DRAFT) (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 1023209 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• PM00675 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
• http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 48577 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• SSA:2009-320-01 (opens in a new tab)vendor-advisoryx_refsource_SLACKWAREx_transferred
• http://www.links.org/?p=789 (opens in a new tab)x_refsource_MISCx_transferred
• http://www.opera.com/docs/changelogs/unix/1060/ (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.html (opens in a new tab)x_refsource_MISCx_transferred
• RHSA-2011:0880 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• SUSE-SR:2010:008 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• [oss-security] 20091107 Re: CVE-2009-3555 for TLS renegotiation MITM attacks (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• FEDORA-2009-12305 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• http://wiki.rpath.com/Advisories:rPSA-2009-0155 (opens in a new tab)x_refsource_CONFIRMx_transferred
• SUSE-SR:2010:012 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• http://support.citrix.com/article/CTX123359 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 37501 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• MDVSA-2010:076 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• HPSBUX02517 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• ADV-2009-3587 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 39632 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 38687 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• https://bugzilla.mozilla.org/show_bug.cgi?id=526689 (opens in a new tab)x_refsource_MISCx_transferred
• MS10-049 (opens in a new tab)vendor-advisoryx_refsource_MSx_transferred
• ADV-2010-0982 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 37399 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• USN-927-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• 1023272 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• FEDORA-2009-12606 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• ADV-2010-3126 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 37320 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2009-3165 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• ADV-2010-1639 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 38020 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• USN-923-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• 39243 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• oval:org.mitre.oval:def:8366 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• 37453 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-030/index.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• ADV-2010-0933 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• http://www.vmware.com/security/advisories/VMSA-2011-0003.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 41972 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2010-3086 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• DSA-2141 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• 1024789 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• RHSA-2010:0155 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• http://www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html (opens in a new tab)x_refsource_MISCx_transferred
• ADV-2011-0033 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• RHSA-2010:0337 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• 1023216 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• 41480 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2011-0086 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 41818 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 37604 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www.opera.com/support/search/view/944/ (opens in a new tab)x_refsource_CONFIRMx_transferred
• [announce] 20091107 CVE-2009-3555 - apache/mod_ssl vulnerability and mitigation (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• SUSE-SR:2010:024 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• TA10-287A (opens in a new tab)third-party-advisoryx_refsource_CERTx_transferred
• http://www.links.org/?p=780 (opens in a new tab)x_refsource_MISCx_transferred
• RHSA-2010:0119 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• 38056 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2010-0748 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 37675 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• oval:org.mitre.oval:def:8535 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• http://www.vmware.com/security/advisories/VMSA-2010-0019.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• RHSA-2010:0786 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt (opens in a new tab)x_refsource_MISCx_transferred
• 38003 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://support.apple.com/kb/HT4171 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 1023428 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• [oss-security] 20091120 CVEs for nginx (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• ADV-2009-3354 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 1023274 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• FEDORA-2009-12968 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• 39242 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• https://kb.bluecoat.com/index?page=content&id=SA50 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 38241 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 42377 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• GLSA-201203-22 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• [oss-security] 20091105 CVE-2009-3555 for TLS renegotiation MITM attacks (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• SUSE-SR:2010:019 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• 60972 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 1023426 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• 38484 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• MDVSA-2010:084 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• http://www.betanews.com/article/1257452450 (opens in a new tab)x_refsource_MISCx_transferred
• 1021653 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
• http://www.mozilla.org/security/announce/2010/mfsa2010-22.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• [4.6] 004: SECURITY FIX: November 26, 2009 (opens in a new tab)vendor-advisoryx_refsource_OPENBSDx_transferred
• 41967 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• RHSA-2010:0807 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• ADV-2010-1191 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 20091111 Re: SSL/TLS MiTM PoC (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• https://support.f5.com/kb/en-us/solutions/public/10000/700/sol10737.html (opens in a new tab)x_refsource_MISCx_transferred
• [oss-security] 20091105 Re: CVE-2009-3555 for TLS renegotiation MITM attacks (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• 39713 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 42733 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 37291 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• FEDORA-2010-16312 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• FEDORA-2010-5942 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• ADV-2010-2745 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 273350 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
• ADV-2010-0994 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• ADV-2010-0173 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• ADV-2010-1054 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 65202 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• HPSBGN02562 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• FEDORA-2010-16294 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• [gnutls-devel] 20091105 Re: TLS renegotiation MITM (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• 20131121 ESA-2013-077: RSA Data Protection Manager Appliance Multiple Vulnerabilities (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• http://clicky.me/tlsvuln (opens in a new tab)x_refsource_MISCx_transferred
• 42811 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20200213 svn commit: r1873980 [31/34] - /tomcat/site/trunk/docs/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.exploit-db.com/exploits/10579 (opens in a new tab)exploit

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-f7w7-6pjc-wwm6 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2009-3555](https://trackcve.app/badge/CVE-2009-3555.svg)](https://trackcve.app/cve/CVE-2009-3555)

Record last updated 27 May 2026, 15:38 UTC.