CVE-2014-3509

CVE-2014-3509 describes a race condition in OpenSSL versions 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, specifically within the ssl_parse_serverhello_tlsext function. This vulnerability, triggered when multithreading and session resumption are active, allows a malicious SSL server to cause a denial of service (memory overwrite and client application crash) or potentially other unspecified impacts by sending crafted Elliptic Curve Supported Point Formats Extension data. With a CVSS score of 6.8, it is considered medium severity due to its network attack vector and medium attack complexity, leading to potential partial confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage, suggesting it is not a widely targeted or discussed vulnerability.