The issue is related to unbounded memory growth when processing TLSv1.3 sessions due to the use of the non-default SSL OP NO TICKET option. This can lead to a Denial of Service. The problem occurs when the session cache gets into an incorrect state and fails to flush properly as it fills. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. This issue only affects TLS servers supporting TLSv1.3 and does not affect TLS clients. The FIPS modules in 3.2, 3.1, and 3.0 are not affected by this issue, nor is OpenSSL 1.0.2.