# openssl-src (crates.io) vulnerabilities 26 known vulnerabilities (13 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 110.0.0 (Aug 29, 2017): affected by 11 advisories - Newest unaffected release: 400.0.2+4.0.3 (Oct 1, 2026) - Weekly downloads: 2.1M - Dependents: 0 - Releases: 91 since 110.0.0 (Aug 29, 2017) - Registry: https://crates.io/crates/openssl-src - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2022-4203: 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it) - CVE-2022-4304: 110.0.0 to 111.24.0+1.1.1s (111.25.0+1.1.1t is outside it); 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it) - CVE-2022-4450: 110.0.0 to 111.24.0+1.1.1s (111.25.0+1.1.1t is outside it); 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it) - CVE-2023-0215: 110.0.0 to 111.24.0+1.1.1s (111.25.0+1.1.1t is outside it); 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it) - CVE-2023-0216: 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it) - CVE-2023-0217: 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it) - CVE-2023-0286: 110.0.0 to 111.24.0+1.1.1s (111.25.0+1.1.1t is outside it); 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it) - CVE-2023-0401: 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it) - CVE-2022-3996: 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it) - CVE-2022-3786: 300.0.0+3.0.0 to 300.0.10+3.0.6 (300.0.11+3.0.7 is outside it) - CVE-2022-3602: 300.0.0+3.0.0 to 300.0.10+3.0.6 (300.0.11+3.0.7 is outside it) - CVE-2022-3358: 300.0.0+3.0.0 to 300.0.9+3.0.5 (300.0.10+3.0.6 is outside it) - CVE-2022-2097: 110.0.0 to 111.21.0+1.1.1p (111.22.0+1.1.1q is outside it); 300.0.0+3.0.0 to 300.0.8+3.0.4 (300.0.9+3.0.5 is outside it) - CVE-2022-2274: 300.0.8+3.0.4 (300.0.9+3.0.5 is outside it) - CVE-2022-1473: 300.0.0+3.0.0 to 300.0.5+3.0.2 (300.0.6+3.0.3 is outside it) - CVE-2022-1434: 300.0.0+3.0.0 to 300.0.5+3.0.2 (300.0.6+3.0.3 is outside it) - CVE-2022-1343: 300.0.0+3.0.0 to 300.0.5+3.0.2 (300.0.6+3.0.3 is outside it) - CVE-2022-0778: 110.0.0 to 111.17.0+1.1.1m (111.18.0+1.1.1n is outside it); 300.0.0+3.0.0 to 300.0.4+3.0.1 (300.0.5+3.0.2 is outside it) - CVE-2021-4044: 300.0.0+3.0.0 to 300.0.3+3.0.0 (300.0.4+3.0.1 is outside it) - CVE-2021-3712: 110.0.0 to 111.15.0+1.1.1k (111.16.0+1.1.1l is outside it) - CVE-2021-3711: 110.0.0 to 111.15.0+1.1.1k (111.16.0+1.1.1l is outside it) - CVE-2021-3450: 111.11.0+1.1.1h to 111.14.0+1.1.1j (111.15.0+1.1.1k is outside it) - CVE-2021-3449: 110.0.0 to 111.14.0+1.1.1j (111.15.0+1.1.1k is outside it) - CVE-2021-23841: 110.0.0 to 111.13.0+1.1.1i (111.14.0+1.1.1j is outside it) - CVE-2021-23840: 110.0.0 to 111.13.0+1.1.1i (111.14.0+1.1.1j is outside it) - CVE-2020-1967: 111.6.0+1.1.1d to 111.8.1+1.1.1f (111.9.0+1.1.1g is outside it) ## Advisories (26) ### [CVE-2022-4203](https://cve.now/CVE-2022-4203): X.509 Name Constraints Read Buffer Overflow - Severity: Medium 4.9 - Published: Feb 24, 2023 - Affected: from 300.0.0, fixed in 300.0.12. - Fixed in 300.0.12+3.0.8 (released Feb 7, 2023, 17 days before disclosure). - The latest release, 110.0.0, is not affected. ### [CVE-2022-4304](https://cve.now/CVE-2022-4304): Timing Oracle in RSA Decryption - Severity: Medium 5.9 - Published: Feb 8, 2023 - Affected: fixed in 111.25.0; from 300.0.0, fixed in 300.0.12; fixed in 111.25.0; from 300.0.0, fixed in 300.0.12. - Fixed in 111.25.0+1.1.1t (released Feb 7, 2023, 1 day before disclosure) and 300.0.12+3.0.8 (released Feb 7, 2023, 1 day before disclosure). - The latest release, 110.0.0, is still affected. ### [CVE-2022-4450](https://cve.now/CVE-2022-4450): Double free after calling PEM\_read\_bio\_ex - Severity: High 7.5 - Published: Feb 8, 2023 - Affected: fixed in 111.25.0; from 300.0.0, fixed in 300.0.12; fixed in 111.25.0; from 300.0.0, fixed in 300.0.12. - Fixed in 111.25.0+1.1.1t (released Feb 7, 2023, 1 day before disclosure) and 300.0.12+3.0.8 (released Feb 7, 2023, 1 day before disclosure). - The latest release, 110.0.0, is still affected. ### [CVE-2023-0215](https://cve.now/CVE-2023-0215): Use-after-free following BIO\_new\_NDEF - Severity: High 7.5 - Published: Feb 8, 2023 - Affected: fixed in 111.25.0; from 300.0.0, fixed in 300.0.12; fixed in 111.25.0; from 300.0.0, fixed in 300.0.12. - Fixed in 111.25.0+1.1.1t (released Feb 7, 2023, 1 day before disclosure) and 300.0.12+3.0.8 (released Feb 7, 2023, 1 day before disclosure). - The latest release, 110.0.0, is still affected. ### [CVE-2023-0216](https://cve.now/CVE-2023-0216): Invalid pointer dereference in d2i\_PKCS7 functions - Severity: High 7.5 - Published: Feb 8, 2023 - Affected: from 300.0.0, fixed in 300.0.12. - Fixed in 300.0.12+3.0.8 (released Feb 7, 2023, 1 day before disclosure). - The latest release, 110.0.0, is not affected. ### [CVE-2023-0217](https://cve.now/CVE-2023-0217): NULL dereference validating DSA public key - Severity: High 7.5 - Published: Feb 8, 2023 - Affected: from 300.0.0, fixed in 300.0.12. - Fixed in 300.0.12+3.0.8 (released Feb 7, 2023, 1 day before disclosure). - The latest release, 110.0.0, is not affected. ### [CVE-2023-0286](https://cve.now/CVE-2023-0286): X.400 address type confusion in X.509 GeneralName - Severity: High 7.4 - Published: Feb 8, 2023 - Affected: fixed in 111.25.0; from 300.0.0, fixed in 300.0.12; fixed in 111.25.0; from 300.0.0, fixed in 300.0.12. - Fixed in 111.25.0+1.1.1t (released Feb 7, 2023, 1 day before disclosure) and 300.0.12+3.0.8 (released Feb 7, 2023, 1 day before disclosure). - The latest release, 110.0.0, is still affected. ### [CVE-2023-0401](https://cve.now/CVE-2023-0401): NULL dereference during PKCS7 data verification - Severity: High 7.5 - Published: Feb 8, 2023 - Affected: from 300.0.0, fixed in 300.0.12. - Fixed in 300.0.12+3.0.8 (released Feb 7, 2023, 1 day before disclosure). - The latest release, 110.0.0, is not affected. ### [CVE-2022-3996](https://cve.now/CVE-2022-3996): X.509 Policy Constraints Double Locking - Severity: High 7.5 - Published: Dec 13, 2022 - Affected: from 300.0.0, fixed in 300.0.12. - Fixed in 300.0.12+3.0.8 (released Feb 7, 2023, 56 days after disclosure). - The latest release, 110.0.0, is not affected. ### [CVE-2022-3786](https://cve.now/CVE-2022-3786): X.509 Email Address Variable Length Buffer Overflow - Severity: High 7.5 - Published: Nov 1, 2022 - Affected: from 300.0.0, fixed in 300.0.11. - Fixed in 300.0.11+3.0.7 (released Nov 1, 2022, the day of disclosure). - The latest release, 110.0.0, is not affected. ### [CVE-2022-3602](https://cve.now/CVE-2022-3602): X.509 Email Address 4-byte Buffer Overflow - Severity: High 7.5 - Published: Nov 1, 2022 - Affected: from 300.0.0, fixed in 300.0.11. - Fixed in 300.0.11+3.0.7 (released Nov 1, 2022, the day of disclosure). - The latest release, 110.0.0, is not affected. ### [CVE-2022-3358](https://cve.now/CVE-2022-3358): Using a Custom Cipher with NID\_undef may lead to NULL encryption - Severity: Unrated - Published: Oct 11, 2022 - Affected: from 300.0.0, fixed in 300.0.10. - Fixed in 300.0.10+3.0.6 (released Oct 11, 2022, the day of disclosure). - The latest release, 110.0.0, is not affected. ### [CVE-2022-2097](https://cve.now/CVE-2022-2097): AES OCB fails to encrypt some bytes - Severity: Unrated - Published: Jul 5, 2022 - Affected: fixed in 111.22.0; from 300.0.0, fixed in 300.0.9; fixed in 111.22.0; from 300.0.0, fixed in 300.0.9. - Fixed in 111.22.0+1.1.1q (released Jul 5, 2022, the day of disclosure) and 300.0.9+3.0.5 (released Jul 5, 2022, the day of disclosure). - The latest release, 110.0.0, is still affected. ### [CVE-2022-2274](https://cve.now/CVE-2022-2274): RSA implementation bug in AVX512IFMA instructions - Severity: Unrated - Published: Jul 1, 2022 - Affected: from 300.0.8, fixed in 300.0.9. - Fixed in 300.0.9+3.0.5 (released Jul 5, 2022, 4 days after disclosure). - The latest release, 110.0.0, is not affected. ### [CVE-2022-1473](https://cve.now/CVE-2022-1473): Resource leakage when decoding certificates and keys - Severity: High 7.5 - Published: May 3, 2022 - Affected: from 300.0.0, fixed in 300.0.6. - Fixed in 300.0.6+3.0.3 (released May 5, 2022, 2 days after disclosure). - The latest release, 110.0.0, is not affected. ### [CVE-2022-1434](https://cve.now/CVE-2022-1434): Incorrect MAC key used in the RC4-MD5 ciphersuite - Severity: Unrated - Published: May 3, 2022 - Affected: from 300.0.0, fixed in 300.0.6. - Fixed in 300.0.6+3.0.3 (released May 5, 2022, 2 days after disclosure). - The latest release, 110.0.0, is not affected. ### [CVE-2022-1343](https://cve.now/CVE-2022-1343): OCSP\_basic\_verify may incorrectly verify the response signing certificate - Severity: Medium 5.3 - Published: May 3, 2022 - Affected: from 300.0.0, fixed in 300.0.6. - Fixed in 300.0.6+3.0.3 (released May 5, 2022, 2 days after disclosure). - The latest release, 110.0.0, is not affected. ### [CVE-2022-0778](https://cve.now/CVE-2022-0778): Infinite loop in BN\_mod\_sqrt() reachable when parsing certificates - Severity: High 7.5 - Published: Mar 15, 2022 - Affected: from 300.0.0, fixed in 300.0.5; fixed in 111.18.0; fixed in 111.18.0; from 300.0.0, fixed in 300.0.5. - Fixed in 111.18.0+1.1.1n (released Mar 16, 2022, 1 day after disclosure) and 300.0.5+3.0.2 (released Mar 16, 2022, 1 day after disclosure). - The latest release, 110.0.0, is still affected. ### [CVE-2021-4044](https://cve.now/CVE-2021-4044): Invalid handling of X509\_verify\_cert() internal errors in libssl - Severity: Unrated - Published: Dec 14, 2021 - Affected: from 300.0.0, fixed in 300.0.4. - Fixed in 300.0.4+3.0.1 (released Dec 14, 2021, the day of disclosure). - The latest release, 110.0.0, is not affected. ### [CVE-2021-3712](https://cve.now/CVE-2021-3712): Read buffer overruns processing ASN.1 strings - Severity: High 7.4 - Published: Aug 24, 2021 - Affected: fixed in 111.16.0; fixed in 111.16.0. - Fixed in 111.16.0+1.1.1l (released Aug 24, 2021, the day of disclosure). - The latest release, 110.0.0, is still affected. ### [CVE-2021-3711](https://cve.now/CVE-2021-3711): SM2 Decryption Buffer Overflow - Severity: Unrated - Published: Aug 24, 2021 - Affected: fixed in 111.16.0; fixed in 111.16.0. - Fixed in 111.16.0+1.1.1l (released Aug 24, 2021, the day of disclosure). - The latest release, 110.0.0, is still affected. ### [CVE-2021-3450](https://cve.now/CVE-2021-3450): CA certificate check bypass with X509\_V\_FLAG\_X509\_STRICT - Severity: Unrated - Published: Mar 25, 2021 - Affected: from 111.11.0, fixed in 111.15.0. - Fixed in 111.15.0+1.1.1k (released Mar 25, 2021, the day of disclosure). - The latest release, 110.0.0, is not affected. ### [CVE-2021-3449](https://cve.now/CVE-2021-3449): NULL pointer deref in signature\_algorithms processing - Severity: Unrated - Published: Mar 25, 2021 - Affected: fixed in 111.15.0; fixed in 111.15.0. - Fixed in 111.15.0+1.1.1k (released Mar 25, 2021, the day of disclosure). - The latest release, 110.0.0, is still affected. ### [CVE-2021-23841](https://cve.now/CVE-2021-23841): Null pointer deref in X509\_issuer\_and\_serial\_hash() - Severity: Unrated - Published: Feb 16, 2021 - Affected: fixed in 111.14.0; fixed in 111.14.0. - Fixed in 111.14.0+1.1.1j (released Feb 18, 2021, 2 days after disclosure). - The latest release, 110.0.0, is still affected. ### [CVE-2021-23840](https://cve.now/CVE-2021-23840): Integer overflow in CipherUpdate - Severity: High 7.5 - Published: Feb 16, 2021 - Affected: fixed in 111.14.0; fixed in 111.14.0. - Fixed in 111.14.0+1.1.1j (released Feb 18, 2021, 2 days after disclosure). - The latest release, 110.0.0, is still affected. ### [CVE-2020-1967](https://cve.now/CVE-2020-1967): Segmentation fault in SSL\_check\_chain - Severity: Unrated - Published: Apr 21, 2020 - Affected: from 111.6.0, fixed in 111.9.0. - Fixed in 111.9.0+1.1.1g (released Apr 21, 2020, the day of disclosure). - The latest release, 110.0.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/crates.io/openssl-src Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.