OpenSSL vulnerabilities
147 CVEs and advisories name OpenSSL as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-95692Out-of-Bounds Read and Incorrect IV Length Handling in AES-GCM-SIV
- CVE-2026-95691Retransmitted QUIC CRYPTO Frames Can Cause DoS or One-byte Disclosure
- CVE-2026-88823AES-GCM-SIV AAD Forgery After Zero-length Incremental AAD Update
- CVE-2026-88822QUIC Uses Uninitialized Stack Bytes During Automated Peer Detection
- CVE-2026-107496Infinite Loop in CMS_encrypt() With an EC Group Order of 1
- CVE-2026-84784QUIC: Unbounded RETIRE_CONNECTION_ID Backlog
- CVE-2026-84783Use-After-Free in X.509 Extension Cache Under Concurrent Use
- CVE-2026-84782DTLS Retransmits Handshake Messages From a Stale Buffer Offset
- CVE-2026-77696Timing Side-Channel in SM2 Signature Generation
- CVE-2026-75806Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS
- CVE-2026-75805NULL Pointer Dereference in CMP Client Revocation Response Handling
- CVE-2026-75804QUIC Connection-Level Flow Control is Not Enforced for Streams
- CVE-2026-72897Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake
- CVE-2026-54875Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V
- CVE-2026-54873QUIC STREAM Fragment Metadata DoS
- CVE-2026-54872Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves
- CVE-2026-42772Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC
- CVE-2026-35191QUIC Unvalidated Amplification Credit may be Over Accounted
- CVE-2026-35189Excessive Memory Allocation in Relative CRLDP Processing
- CVE-2026-75803AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()
- CVE-2026-63076Invalid Pointer Dereference in CMP Server via Crafted protectionAlg
- CVE-2026-63075QUIC ACK-only Packet Retention Can Cause Memory Exhaustion
- CVE-2026-63074CMP Indefinite Cache Growth of ExtraCerts
- CVE-2026-63073Untrusted Sender DN Used as Format String in CMP Response Validation
- CVE-2026-63072Heap Buffer Overflow in CMS Key Unwrapping
- CVE-2026-54874Excessive Memory Use Buffering DTLS Records for a Future Epoch
- CVE-2026-18798QUIC Server May Trigger Double Free When Processing INITIAL Packet
- CVE-2026-14457RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate
- CVE-2026-14456Unbounded Memory Growth in QUIC Server Incoming Channel Queue
- CVE-2026-54876Client-Side Memory Leak in OCSP Response Checking