Overview
CVE-2025-52494 is a critical vulnerability in the Adacore Ada Web Server (AWS) versions prior to 25.2. It exposes the server to potential denial-of-service (DoS) attacks due to improper handling of SSL handshakes during connection initialization. This vulnerability matters because it poses a significant risk to the availability of the affected servers, potentially leading to system compromise or data leakage.
Vulnerability Summary
CVE ID: CVE-2025-52494
Severity: High (CVSS: 7.5)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
Adacore Ada Web Server | Until version 24.2
How the Exploit Works
The vulnerability lies in the way AWS handles SSL handshakes during the initialization of a connection. When a client initiates an HTTPS connection, the server performs the SSL handshake before assigning the connection to a processing slot. However, no specific timeout is set for this phase and the server uses the default socket timeout, which is effectively infinite. An attacker can exploit this by sending a malformed TLS ClientHello message with incorrect length values, causing the server to wait indefinitely for data that never arrives. By opening multiple such connections, up to the server’s maximum limit, the attacker can exhaust all available working threads, preventing the server from handling new, legitimate requests.
Conceptual Example Code
Below is a conceptual example of how the vulnerability might be exploited. An attacker sends a malformed TLS ClientHello message with incorrect length values:
CONNECT target.example.com:443 HTTP/1.1
Host: target.example.com
ClientHello (malformed with incorrect length values)Note:
This is a conceptual example and not actual exploit code. It serves to illustrate the nature of the vulnerability.