Skip to content

X.509DoS: Exploiting and Detecting Denial-of-Service Vulnerabilities in Cryptographic Libraries Using Crafted X.509 Certificates#

USENIX Security '25 (34th USENIX Security Symposium) digest Program Core pick 13–15 August 2025

Recording

Bing Shi et al., Alibaba Group; Luyi Xing, Indiana University Bloomington — Core

Play the recording: X.509DoS: Exploiting and Detecting Denial-of-Service Vulnerabilities in Cryptographic Libraries Using Crafted X.509 Certificates

  • Why: A systematic study of an underexplored class of cryptographic-library vulnerability — availability, not confidentiality/integrity — finding 18 new and 12 previously known CVEs across seven mainstream crypto libraries, all reachable via crafted certificates rather than exotic inputs.
  • What: X.509DoS, a class of denial-of-service attacks against cryptographic library implementations, launched via specially crafted X.509 certificates; a tool for rapidly generating such certificates and detecting the underlying DoS vulnerabilities. (from abstract only)
  • How: Systematically probes implementations handling X.509 certificates for availability-impacting bugs, showing that spec/standard compliance alone does not guarantee resistance to resource-exhaustion attacks. (from abstract only)
  • Where applicable: General for any service parsing/validating X.509 certificates from untrusted input (TLS servers, mTLS endpoints); the finding that standards-compliance ≠ DoS-safety generalizes beyond the seven libraries tested.