OpenSSL

Latest vulnerabilities

• CVE-2026-84784 CVSS 7.5 high Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many…
• CVE-2026-84783 CVSS 7.5 high Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed…
• CVE-2026-84782 CVSS 8.2 high Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The…
• CVE-2026-77696 CVSS 3.7 low Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary…
• CVE-2026-75806 CVSS 5.3 medium Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose…
• CVE-2026-75805 CVSS 5.3 medium Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and…
• CVE-2026-75804 CVSS 5.3 medium Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as…
• CVE-2026-72897 CVSS 7.5 high Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may…
• CVE-2026-54875 CVSS 3.7 low Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64…
• CVE-2026-54873 CVSS 7.5 high Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can…
• CVE-2026-54872 CVSS 3.7 low Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a…
• CVE-2026-42772 CVSS 5.3 medium Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst…
• CVE-2026-35191 CVSS 3.7 low Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets…
• CVE-2026-35189 CVSS 5.3 medium Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL…
• CVE-2026-75803 CVSS 9.1 critical Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied…
• CVE-2026-63076 CVSS 7.5 high Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its…
• CVE-2026-63075 CVSS 7.5 high Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging…
• CVE-2026-63074 CVSS 5.9 medium Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but…
• CVE-2026-63073 CVSS 9.8 critical Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to…
• CVE-2026-63072 CVSS 7.5 high Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD…
• CVE-2026-54874 CVSS 7.5 high Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than…
• CVE-2026-18798 CVSS 7.5 high Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact…
• CVE-2026-14457 CVSS 7.5 high Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no…
• CVE-2026-14456 CVSS 7.5 high Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection…
• CVE-2026-9076 CVSS 7.5 high Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen…
• CVE-2026-7383 CVSS 8.1 high Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap…
• CVE-2026-45447 CVSS 8.8 high Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification…
• CVE-2026-45446 CVSS 4.8 medium Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional…
• CVE-2026-45445 CVSS 7.5 high Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied…
• CVE-2026-42770 CVSS 3.7 low Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the…