Vulnerability Disclosure: DTLS clear application data messages in epoch 0

Affected Users:

Anyone using DTLS with wolfSSL versions prior to release 4.5.0.


An issue was discovered in the DTLS handshake implementation in wolfSSL before 4.5.0. Clear DTLS application_data messages in epoch 0 do not produce an out-of-order error. Instead, these messages are returned to the application.


Update to wolfSSL version 4.5.0.


The research for this vulnerability is not yet publicly available, a public disclosure containing more details is currently scheduled for November 15th, 2020. CVE-2020-24585 has been reserved for when the public disclosure is made available.

Additional Details:

More available upon public disclosure of research. The patch fixing this issue can be viewed at this link:

Please contact if you have any questions.