What is CVE-2010-5298?

CVE-2010-5298 is a vulnerability in Mariadb, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). Published 2014-04-14.

Is CVE-2010-5298 known to be exploited?

11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Mariadb

CVE-2010-5298

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.

Vulnerability class: Race Condition

Published 2014-04-14 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 4.0 (Medium). Vector: AV:N/AC:H/Au:N/C:N/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.341 (98.4th percentile), scored 2026-09-27.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.341 · newest: 0.341 · change: 0.000

Affected products

Mariadb
OpenSSL
Fedoraproject Fedora — versions 19, 20
SUSE Linux Enterprise Desktop — versions 12
SUSE Linux Enterprise Server — versions 12
SUSE Linux Enterprise Software Development Kit — versions 12
SUSE Linux Enterprise Workstation Extension — versions 12

Weakness classification (CWE)

CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

Public proof-of-concept exploits

References

secunia.com/advisories/59342 (Not Applicable, third-party-advisory)
secunia.com/advisories/59669 (Not Applicable, third-party-advisory)
www.securityfocus.com/bid/66801 (VDB Entry, Third Party Advisory, vdb-entry)
marc.info/ (vendor-advisory, Mailing List, Third Party Advisory)
www.vmware.com/security/advisories/VMSA-2014-0012.html (Third Party Advisory)
www-01.ibm.com/support/docview.wss (Third Party Advisory)
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay (Third Party Advisory)
www-01.ibm.com/support/docview.wss (Broken Link)
www-01.ibm.com/support/docview.wss (Third Party Advisory)
marc.info/ (vendor-advisory, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2010-5298?: CVE-2010-5298 is a vulnerability in Mariadb, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). Published 2014-04-14.
Is CVE-2010-5298 known to be exploited?: 11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.