Skip to content

Technology

OpenSSL vulnerabilities

The OpenSSL cryptography library and its distribution packages. 808 published CVES affecting OpenSSL, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
808
Critical
71
High
294
Medium
282
Low
36
Unscored
125
CISA KEV
1
Atom feed of OpenSSL alerts

Latest OpenSSL CVEs

Newest publication first · page 6 of 33

  2. CVE-2026-42767 NULL Pointer Dereference in CRMF EncryptedValue Decryption

    Published
    MediumCVSS 5.9 EPSS 0.56%

    Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a...

  3. CVE-2026-42766 Possible NULL Dereference in Password-Based CMS Decryption

    Published
    MediumCVSS 5.9 EPSS 1.1%

    Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorith...

  4. CVE-2026-42765 NULL Dereference in Certificate Verification with OCSP Checking

    Published
    HighCVSS 7.5 EPSS 0.51%

    Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process. Impact summary: A NULL pointer...

  5. CVE-2026-42764 NULL Pointer Dereference in QUIC Server Initial Packet Handling

    Published
    HighCVSS 7.5 EPSS 1.2%

    Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server proc...

  6. CVE-2026-35188 Double-free When Checking OCSP Stapled Response

    Published
    MediumCVSS 5.0 EPSS 0.30%

    Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free in the client's certificate verification path. Impact summary: Successful exploitation allows an attacker to corrupt hea...

  7. CVE-2026-34183 Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

    Published
    HighCVSS 7.5 EPSS 1.0%

    Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the applicat...

  8. CVE-2026-34181 PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys

    Published
    HighCVSS 7.4 EPSS 0.38%

    Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user ca...

  9. CVE-2026-34182 CMS AuthEnvelopedData Processing May Accept Forged Messages

    Published
    CriticalCVSS 9.1 EPSS 1.1%

    Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities...

  10. CVE-2026-34180 Heap Buffer Over-read in ASN.1 Content Parsing

    Published
    HighCVSS 7.5 EPSS 1.0%

    Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial...

  11. CVE-2026-9076 Out-of-Bounds Read in CMS Password-Based Decryption

    Published
    HighCVSS 7.5 EPSS 0.71%

    Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read may trigger a crash wh...

  12. CVE-2026-7383 Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion

    Published
    HighCVSS 8.1 EPSS 0.80%

    Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined...

  13. CVE-2026-41859 A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the...

    Published
    HighCVSS 7.1 EPSS 0.10%

    A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administrative director acces...

  14. CVE-2026-41860 CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-cod...

    Published
    HighCVSS 7.1 EPSS 0.07%

    CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-code OpenSSL::SSL::VERIFY_NONE, enabling an attacker to intercept traffic between b...

  15. CVE-2022-49036 An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to...

    Published
    HighCVSS 7.8 EPSS 0.12%

    An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors.

  19. CVE-2026-48697 FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() function in src/fast_library.cpp creates a boost::asio::ssl:...

    Published
    HighCVSS 7.4 EPSS 0.16%

    FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() function in src/fast_library.cpp creates a boost::asio::ssl::context with tls_client mode and calls set_default_verify_paths() to load CA ce...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.