CVE-2025-52494
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAdacore Ada Web Server (AWS) before 25.2 is vulnerable to a denial-of-service (DoS) condition due to improper handling of SSL handshakes during connection initialization. When a client initiates an HTTPS connection, the server performs the SSL handshake before assigning the connection to a processing slot. However, there is no specific timeout set for this phase, and the server uses the default socket timeout, which is effectively infinite. An attacker can exploit this by sending a malformed TLS ClientHello message with incorrect length values. This causes the server to wait indefinitely for data that never arrives, blocking the worker thread (Line) handling the connection. By opening multiple such connections, up to the server's maximum limit, the attacker can exhaust all available working threads, preventing the server from handling new, legitimate requests.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceAdacore AWS before 25.2 lacks a timeout for SSL handshakes, using the default socket timeout (effectively infinite). Attackers send malformed TLS ClientHello messages with incorrect length values, causing the server to block waiting for data that never arrives, exhausting worker threads and preventing legitimate connections.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 26.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Determine AWS server versionLocate the installed Adacore AWS (Ada Web Server) version using the package manager, binary version string, or server banner if available. Common commands: 'aws --version', checking the GNAT/Ada installation, or inspecting the server binary.Affected if Version is before 26.0 (any version shown as 25.x or earlier)
-
Confirm SSL/TLS is enabledInspect the AWS server configuration files or runtime settings to verify SSL/TLS is enabled for any listening ports. Look for SSL, TLS, HTTPS, or certificate-related configuration parameters.Affected if SSL/TLS is actively configured and in use for connections
-
Check socket timeout configurationExamine the server configuration for socket timeout values set at connection or SSL level. Look for parameters controlling read timeout, connection timeout, or handshake timeout. If no specific SSL handshake timeout is defined, the default socket timeout applies.Affected if No explicit SSL handshake timeout is configured, or the socket timeout is set to unlimited/very high value (effectively infinite)
-
Identify exposed SSL endpointsReview the server's listening ports and verify which ones accept SSL/TLS connections. Check if worker threads are handling SSL handshake operations.Affected if SSL-enabled endpoints are exposed to the network
You are affected if running Adacore AWS version before 26.0 with SSL/TLS enabled and without a specific handshake timeout configured, allowing malformed ClientHello messages to block worker threads indefinitely.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped26.0
Upgrade to AWS version 25.2 or later, which implements a specific timeout for SSL handshake phase. Alternatively, configure a finite socket timeout at the connection level to limit how long the server waits during SSL handshake.
Ada Web Server (AWS) version 26.0
- 1. Identify the current installed version of Ada Web Server (AWS) by checking your project dependencies or running `aws --version` if available.
- 2. Obtain the fixed version of Ada Web Server 26.0 or later from the official AdaCore distribution (https://www.adacore.com/download).
- 3. Update your project dependencies or package manager configuration to specify AWS version 26.0 or higher.
- 4. Rebuild and recompile your project to incorporate the new AWS library.
- 5. Deploy the updated application and verify HTTPS connections function correctly.
- 6. Monitor server resource usage to confirm the DoS vulnerability is mitigated and worker threads are no longer blocked indefinitely.
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,800.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-52494 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-52494 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data