CVE-2026-14456 | High | 7.5 | 2026-08-13 | Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes
valid QUIC Initial packets for unknown destination connection IDs, it
can allocate a… |
CVE-2026-54876 | High | 7.5 | 2026-08-05 | Issue summary: A malicious TLS server can cause a memory leak in a TLS
client that has enabled OCSP response checking by sending an OCSP
response that contains… |
CVE-2026-9076 | High | 7.5 | 2026-06-09 | Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)
processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK
cipher… |
CVE-2026-7383 | High | 8.1 | 2026-06-09 | Issue summary: A signed integer overflow when sizing the destination
buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap
buffer overflow.
Im… |
CVE-2026-45447 | High | 8.8 | 2026-06-09 | Issue summary: A specially crafted PKCS#7 or S/MIME signed message could
trigger a use-after-free during PKCS#7 signature verification.
Impact summary: A use-… |
CVE-2026-45446 | Medium | 4.8 | 2026-06-09 | Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV
(RFC 8452) mishandle the authentication of AAD (Additional Authenticated
Data) with an… |
CVE-2026-45445 | High | 7.5 | 2026-06-09 | Issue summary: When an application drives an AES-OCB context through the
public EVP_Cipher() one-shot interface, the application-supplied
initialisation vector… |
CVE-2026-42771 | Medium | 6.2 | 2026-06-09 | Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an
application to validate a crafted e-mail address, such as during S/MIME
message validation… |
CVE-2026-42770 | Low | 3.7 | 2026-06-09 | Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42)
peer key, the peer key is not properly checked for the subgroup membership.
Impact… |
CVE-2026-42769 | Medium | 5.3 | 2026-06-09 | Issue Summary: An error in the callback used to verify the certificate
provided in a Root CA key update Certificate Management Protocol (CMP)
message response… |
CVE-2026-42768 | Low | 3.7 | 2026-06-09 | Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to
Bleichenbacher-style attack when an attacker is able to provide the CMS or
S/MIME… |
CVE-2026-42767 | Medium | 5.9 | 2026-06-09 | Issue summary: An attacker-controlled CMP (Certificate Management Protocol)
server could trigger a NULL pointer dereference in a CMP client application.
Impac… |
CVE-2026-42766 | Medium | 5.9 | 2026-06-09 | Issue summary: A specially crafted password-encrypted CMS message
can trigger a NULL pointer dereference during CMS decryption.
Impact summary: This NULL poin… |
CVE-2026-42765 | High | 7.5 | 2026-06-09 | Issue summary: When a partial-chain certificate verification is enabled
together with OCSP response checking for the whole chain, a NULL dereference
will happe… |
CVE-2026-42764 | High | 7.5 | 2026-06-09 | Issue summary: Receiving a QUIC initial packet with an invalid token may
trigger a NULL pointer dereference in the OpenSSL QUIC server with
address validation… |
CVE-2026-35188 | Medium | 5.0 | 2026-06-09 | Issue summary: A malicious server can exploit TLS OCSP stapling by delivering
a crafted response through the status_request extension, triggering a
double-free… |
CVE-2026-34183 | High | 7.5 | 2026-06-09 | Issue summary: Remote peer may exhaust heap memory of the QUIC
server or client by flooding it with packets containing PATH_CHALLENGE
frames.
Impact summary… |
CVE-2026-34182 | Critical | 9.1 | 2026-06-09 | Issue Summary: Cryptographic Message Services (CMS) processing fails to perform
sufficient input validation on the cipher and tag length fields of
AuthEnvelope… |
CVE-2026-34181 | High | 7.4 | 2026-06-09 | Issue Summary: The PKCS#12 file processing fails to perform sufficient input
validation for files that use Password-Based Message Authentication Code 1
(PBMAC1… |
CVE-2026-34180 | High | 7.5 | 2026-06-09 | Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive
element whose content exceeds 2 gigabytes in length may cause a heap buffer
over-… |
CVE-2026-31790 | High | 7.5 | 2026-04-07 | Issue summary: Applications using RSASVE key encapsulation to establish
a secret encryption key can send contents of an uninitialized memory buffer to
a malici… |
CVE-2026-31789 | Critical | 9.8 | 2026-04-07 | Issue summary: Converting an excessively large OCTET STRING value to
a hexadecimal string leads to a heap buffer overflow on 32 bit platforms.
Impact summary… |
CVE-2026-28390 | High | 7.5 | 2026-04-07 | Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyTransportRecipientInfo a NULL pointer dereference can happen.
Impact summary… |
CVE-2026-28389 | High | 7.5 | 2026-04-07 | Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Appl… |
CVE-2026-28388 | High | 7.5 | 2026-04-07 | Issue summary: When a delta CRL that contains a Delta CRL Indicator extension
is processed a NULL pointer dereference might happen if the required CRL
Number e… |
CVE-2026-28387 | High | 8.1 | 2026-04-07 | Issue summary: An uncommon configuration of clients performing DANE TLSA-based
server authentication, when paired with uncommon server DANE TLSA records, may
r… |
CVE-2026-28386 | High | 7.5 | 2026-04-07 | Issue summary: Applications using AES-CFB128 encryption or decryption on
systems with AVX-512 and VAES support can trigger an out-of-bounds read
of up to 15 by… |
CVE-2026-2673 | Medium | 6.5 | 2026-03-13 | Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected
preferred key exchange group when its key exchange group configuration includes
the… |
CVE-2026-22796 | Medium | 5.3 | 2026-01-27 | Issue summary: A type confusion vulnerability exists in the signature
verification of signed PKCS#7 data where an ASN1_TYPE union member is
accessed without fi… |
CVE-2026-22795 | Medium | 5.5 | 2026-01-27 | Issue summary: An invalid or NULL pointer dereference can happen in
an application processing a malformed PKCS#12 file.
Impact summary: An application process… |
CVE-2025-69421 | High | 7.5 | 2026-01-27 | Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer
dereference in the PKCS12_item_decrypt_d2i_ex() function.
Impact summary: A NULL… |
CVE-2025-69420 | High | 7.5 | 2026-01-27 | Issue summary: A type confusion vulnerability exists in the TimeStamp Response
verification code where an ASN1_TYPE union member is accessed without first
vali… |
CVE-2025-69419 | High | 7.4 | 2026-01-27 | Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously
crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing
non-ASCII… |
CVE-2025-69418 | Medium | 4.0 | 2026-01-27 | Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 1… |
CVE-2025-68160 | Medium | 4.7 | 2026-01-27 | Issue summary: Writing large, newline-free data into a BIO chain using the
line-buffering filter where the next BIO performs short writes can trigger
a heap-ba… |
CVE-2025-66199 | Medium | 5.9 | 2026-01-27 | Issue summary: A TLS 1.3 connection using certificate compression can be
forced to allocate a large buffer before decompression without checking
against the co… |
CVE-2025-15469 | Medium | 5.5 | 2026-01-27 | Issue summary: The 'openssl dgst' command-line tool silently truncates input
data to 16MB when using one-shot signing algorithms and reports success instead
of… |
CVE-2025-15468 | Medium | 5.9 | 2026-01-27 | Issue summary: If an application using the SSL_CIPHER_find() function in
a QUIC protocol client or server receives an unknown cipher suite from
the peer, a NUL… |
CVE-2025-15467 | High | 8.8 | 2026-01-27 | Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with
maliciously crafted AEAD parameters can trigger a stack buffer overflow.
Impact sum… |
CVE-2025-11187 | Medium | 6.1 | 2026-01-27 | Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation
which can trigger a stack-based buffer overflow, invalid pointer or NULL
pointer deref… |
CVE-2025-9232 | Medium | 5.9 | 2025-09-30 | Issue summary: An application using the OpenSSL HTTP client API functions may
trigger an out-of-bounds read if the 'no_proxy' environment variable is set and
t… |
CVE-2025-9231 | Medium | 6.5 | 2025-09-30 | Issue summary: A timing side-channel which could potentially allow remote
recovery of the private key exists in the SM2 algorithm implementation on 64 bit
ARM… |
CVE-2025-9230 | High | 7.5 | 2025-09-30 | Issue summary: An application trying to decrypt CMS messages encrypted using
password based encryption can trigger an out-of-bounds read and write.
Impact sum… |
CVE-2025-4575 | Medium | 6.5 | 2025-05-22 | Issue summary: Use of -addreject option with the openssl x509 application adds
a trusted use instead of a rejected use for a certificate.
Impact summary: If a… |
CVE-2024-12797 | Medium | 6.3 | 2025-02-11 | Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a
server may fail to notice that the server was not authenticated, because
handshak… |
CVE-2024-13176 | Medium | 4.1 | 2025-01-20 | Issue summary: A timing side-channel which could potentially allow recovering
the private key exists in the ECDSA signature computation.
Impact summary: A tim… |
CVE-2024-4741 | High | 7.5 | 2024-11-13 | Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause
memory to be accessed that was previously freed in some situations
Impact summary… |
CVE-2024-9143 | Medium | 4.3 | 2024-10-16 | Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted
explicit values for the field polynomial can lead to out-of-bounds memory reads
… |
CVE-2024-6119 | High | 7.5 | 2024-09-03 | Issue summary: Applications performing certificate name checks (e.g., TLS
clients checking server certificates) may attempt to read an invalid memory
address r… |
CVE-2024-5535 | Critical | 9.1 | 2024-06-27 | Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an
empty supported client protocols buffer may cause a crash or memory contents to
b… |
CVE-2024-4603 | Medium | 5.3 | 2024-05-16 | Issue summary: Checking excessively long DSA keys or parameters may be very
slow.
Impact summary: Applications that use the functions EVP_PKEY_param_check()
o… |
CVE-2023-6237 | Medium | 5.9 | 2024-04-25 | Issue summary: Checking excessively long invalid RSA public keys may take
a long time.
Impact summary: Applications that use the function EVP_PKEY_public_chec… |
CVE-2024-2511 | Medium | 5.9 | 2024-04-08 | Issue summary: Some non-default TLS server configurations can cause unbounded
memory growth when processing TLSv1.3 sessions
Impact summary: An attacker may e… |
CVE-2024-0727 | Medium | 5.5 | 2024-01-26 | Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL
to crash leading to a potential Denial of Service attack
Impact summary: Applic… |
CVE-2023-6129 | Medium | 6.5 | 2024-01-09 | Issue summary: The POLY1305 MAC (message authentication code) implementation
contains a bug that might corrupt the internal state of applications running
on Po… |
CVE-2023-5678 | Medium | 5.3 | 2023-11-06 | Issue summary: Generating excessively long X9.42 DH keys or checking
excessively long X9.42 DH keys or parameters may be very slow.
Impact summary: Applicatio… |
CVE-2023-5363 | High | 7.5 | 2023-10-25 | Issue summary: A bug has been identified in the processing of key and
initialisation vector (IV) lengths. This can lead to potential truncation
or overruns du… |
CVE-2023-4807 | High | 7.8 | 2023-09-08 | Issue summary: The POLY1305 MAC (message authentication code) implementation
contains a bug that might corrupt the internal state of applications on the
Window… |
CVE-2023-3817 | Medium | 5.3 | 2023-07-31 | Issue summary: Checking excessively long DH keys or parameters may be very slow.
Impact summary: Applications that use the functions DH_check(), DH_check_ex()… |
CVE-2023-3446 | Medium | 5.3 | 2023-07-19 | Issue summary: Checking excessively long DH keys or parameters may be very slow.
Impact summary: Applications that use the functions DH_check(), DH_check_ex()… |
CVE-2023-2975 | Medium | 5.3 | 2023-07-14 | Issue summary: The AES-SIV cipher implementation contains a bug that causes
it to ignore empty associated data entries which are unauthenticated as
a consequen… |
CVE-2023-2650 | Medium | 6.5 | 2023-05-30 | Issue summary: Processing some specially crafted ASN.1 object identifiers or
data containing them may be very slow.
Impact summary: Applications that use OBJ_… |
CVE-2023-1255 | Medium | 5.9 | 2023-04-20 | Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM
platform contains a bug that could cause it to read past the input buffer,
leading t… |
CVE-2023-0466 | Medium | 5.3 | 2023-03-28 | The function X509_VERIFY_PARAM_add0_policy() is documented to
implicitly enable the certificate policy check when doing certificate
verification. However the i… |
CVE-2023-0465 | Medium | 5.3 | 2023-03-28 | Applications that use a non-default option when verifying certificates may be
vulnerable to an attack from a malicious CA to circumvent certain checks.
Invali… |
CVE-2023-0464 | High | 7.5 | 2023-03-22 | A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy… |
CVE-2022-4203 | Medium | 4.9 | 2023-02-24 | A read buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs
after certificate cha… |
CVE-2023-0401 | High | 7.5 | 2023-02-08 | A NULL pointer can be dereferenced when signatures are being
verified on PKCS7 signed or signedAndEnveloped data. In case the hash
algorithm used for the signa… |
CVE-2023-0286 | High | 7.4 | 2023-02-08 | There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the… |
CVE-2023-0217 | High | 7.5 | 2023-02-08 | An invalid pointer dereference on read can be triggered when an
application tries to check a malformed DSA public key by the
EVP_PKEY_public_check() function… |
CVE-2023-0216 | High | 7.5 | 2023-02-08 | An invalid pointer dereference on read can be triggered when an
application tries to load malformed PKCS7 data with the
d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKC… |
CVE-2023-0215 | High | 7.5 | 2023-02-08 | The public API function BIO_new_NDEF is a helper function used for streaming
ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the
SM… |
CVE-2022-4450 | High | 7.5 | 2023-02-08 | The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and
decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data.
If the… |
CVE-2022-4304 | Medium | 5.9 | 2023-02-08 | A timing based side channel exists in the OpenSSL RSA Decryption implementation
which could be sufficient to recover a plaintext across a network in a
Bleichen… |
CVE-2022-3996 | High | 7.5 | 2022-12-13 | If an X.509 certificate contains a malformed policy constraint and
policy processing is enabled, then a write lock will be taken twice
recursively. On some op… |
CVE-2022-3786 | High | 7.5 | 2022-11-01 | A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain si… |
CVE-2022-3602 | High | 7.5 | 2022-11-01 | A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain si… |
CVE-2022-3358 | High | 7.5 | 2022-10-11 | OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL… |
CVE-2022-2097 | Medium | 5.3 | 2022-07-05 | AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. Th… |
CVE-2022-2274 | Critical | 9.8 | 2022-07-01 | The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA i… |
CVE-2022-2068 | High | 7.3 | 2022-06-21 | In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise she… |
CVE-2022-1473 | High | 7.5 | 2022-05-03 | The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This f… |
CVE-2022-1434 | Medium | 5.9 | 2022-05-03 | The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attack… |
CVE-2022-1343 | Medium | 5.3 | 2022-05-03 | The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the r… |
CVE-2022-1292 | High | 7.3 | 2022-05-03 | The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a man… |
CVE-2022-0778 | High | 7.5 | 2022-03-15 | The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this functi… |
CVE-2021-4160 | Medium | 5.9 | 2022-01-28 | There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Im… |
CVE-2021-4044 | High | 7.5 | 2021-12-14 | Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative retu… |
CVE-2021-3712 | High | 7.4 | 2021-08-24 | ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buf… |
CVE-2021-3711 | Critical | 9.8 | 2021-08-24 | In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function… |
CVE-2021-3450 | High | 7.4 | 2021-03-25 | The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from… |
CVE-2021-3449 | Medium | 5.9 | 2021-03-25 | An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the… |
CVE-2021-23841 | Medium | 5.9 | 2021-02-16 | The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained withi… |
CVE-2021-23840 | High | 7.5 | 2021-02-16 | Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the… |
CVE-2021-23839 | Low | 3.7 | 2021-02-16 | OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versio… |
CVE-2020-1971 | Medium | 5.9 | 2020-12-08 | The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a fu… |
CVE-2020-1968 | Low | 3.7 | 2020-09-09 | The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have… |
CVE-2020-1967 | High | 7.5 | 2020-04-21 | Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a res… |
CVE-2020-7043 | Critical | 9.1 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do… |
CVE-2020-7042 | Medium | 5.3 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check ope… |