Openssl - vulnerabilities (CVEs)

324 CVEs in 3 products, 14 in the last 30 days, newest from 2026-09-29.

Products

• Openssl - 312 CVEs
• Fips Object Module - 1 CVEs
• Openssl Extension Of Ruby Git Trunk - 1 CVEs

Newest CVEs of Openssl

• CVE-2026-84784 - CVSS 7.5 (high), 2026-09-29: Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the…
• CVE-2026-84783 - CVSS 7.5 (high), 2026-09-29: Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread…
• CVE-2026-84782 - CVSS 8.2 (high), 2026-09-29: Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message…
• CVE-2026-77696 - CVSS 3.7 (low), 2026-09-29: Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to…
• CVE-2026-75806 - CVSS 5.3 (medium), 2026-09-29: Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment…
• CVE-2026-75805 - CVSS 5.3 (medium), 2026-09-29: Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when…
• CVE-2026-75804 - CVSS 5.3 (medium), 2026-09-29: Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the…
• CVE-2026-72897 - CVSS 7.5 (high), 2026-09-29: Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond…
• CVE-2026-54875 - CVSS 3.7 (low), 2026-09-29: Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V…
• CVE-2026-54873 - CVSS 7.5 (high), 2026-09-29: Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this…
• CVE-2026-54872 - CVSS 3.7 (low), 2026-09-29: Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated…
• CVE-2026-42772 - CVSS 5.3 (medium), 2026-09-29: Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a…
• CVE-2026-35191 - CVSS 3.7 (low), 2026-09-29: Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its…
• CVE-2026-35189 - CVSS 5.3 (medium), 2026-09-29: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509…
• CVE-2026-75803 - CVSS 9.1 (critical), 2026-08-25: Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the…
• CVE-2026-63076 - CVSS 7.5 (high), 2026-08-25: Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before…
• CVE-2026-63075 - CVSS 7.5 (high), 2026-08-25: Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the…
• CVE-2026-63074 - CVSS 5.9 (medium), 2026-08-25: Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them…
• CVE-2026-63073 - CVSS 9.8 (critical), 2026-08-25: Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`.…
• CVE-2026-63072 - CVSS 7.5 (high), 2026-08-25: Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can…
• CVE-2026-54874 - CVSS 7.5 (high), 2026-08-25: Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself…
• CVE-2026-18798 - CVSS 7.5 (high), 2026-08-25: Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads…
• CVE-2026-14457 - CVSS 7.5 (high), 2026-08-25: Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate)…
• CVE-2026-14456 - CVSS 7.5 (high), 2026-08-13: Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate…
• CVE-2026-54876 - CVSS 7.5 (high), 2026-08-05: Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that…
• CVE-2026-9076 - CVSS 7.5 (high), 2026-06-09: Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher…
• CVE-2026-7383 - CVSS 8.1 (high), 2026-06-09: Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow.…
• CVE-2026-45447 - CVSS 8.8 (high), 2026-06-09: Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A…
• CVE-2026-45446 - CVSS 4.8 (medium), 2026-06-09: Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with…
• CVE-2026-45445 - CVSS 7.5 (high), 2026-06-09: Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation…