CVE-2020-27222
CVE-2020-27222 is a high-severity vulnerability in Eclipse Californium with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-372.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- CVSS v2: 5.0
- EPSS exploit prediction: 1% (54th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-372
- Affected product: Eclipse Californium
- Published:
- Last modified:
Description
In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS server side sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DTLS handshake failure with TLS parameter mismatch. The DTLS server side must be restarted to recover this. This allow clients to force a DoS.
Frequently asked questions
- What is CVE-2020-27222?
- In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS server side sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DTLS handshake failure with TLS parameter mismatch. The DTLS server side must be restarted to recover this. This allow clients to force a DoS.
- How severe is CVE-2020-27222?
- CVE-2020-27222 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2020-27222 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (54th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2020-27222?
- CVE-2020-27222 affects Eclipse Californium. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2020-27222?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2020-27222 published?
- CVE-2020-27222 was published on 2021-02-03 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:eclipse:californium:*:*:*:*:*:*:*:*
More vulnerabilities in Eclipse Californium
- CVE-2022-39368 — High (CVSS 8.2): Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In…
- CVE-2022-2576 — High (CVSS 7.5): In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full…
- CVE-2021-34433 — High (CVSS 7.5): In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS…
All CVEs affecting Eclipse Californium →
Other CWE-372 vulnerabilities
- CVE-2024-22590 — Critical (CVSS 9.1): The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection. This vulnerability can allow…
- CVE-2023-4012 — High (CVSS 7.5): ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode…
- CVE-2026-41388 — Medium (CVSS 6.5): OpenClaw before 2026.3.31 contains a configuration management vulnerability where startup migration treats empty-array…
- CVE-2026-41340 — Medium (CVSS 6.5): OpenClaw before 2026.3.31 contains an authentication boundary vulnerability where Telegram legacy allowFrom migration…
- CVE-2026-41300 — Medium (CVSS 6.5): OpenClaw before 2026.3.31 contains a trust-decline vulnerability that preserves attacker-discovered endpoints in remote…
- CVE-2023-36834 — Medium (CVSS 6.5): An Incomplete Internal State Distinction vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos…