A timing side-channel vulnerability exists in OpenSSL's SM2 signature generation, where non-constant-time arithmetic on secret values may allow attackers to infer sensitive information. This issue affects multiple OpenSSL versions used in various Ubuntu LTS releases. The vulnerability has a low CVSS score of 3.7 and does not impact integrity or availability. Official patches are available from Ubuntu to address this issue.
A performance degradation vulnerability exists in Node.js's QUIC stream reassembly algorithm, where out-of-order packets cause progressively worse performance with quadratic complexity. This can be exploited by a remote QUIC peer to cause CPU resource exhaustion and potential denial of service with low bandwidth. The issue affects multiple specific Node.js versions and has a CVSS score of 5.3 (low severity). A patch is available.
CVE-2026-54872 is a timing side-channel vulnerability in OpenSSL's generic elliptic-curve scalar multiplication implementation used for ECDSA and SM2 signature operations on certain curves without dedicated constant-time code. The vulnerability leaks information about the secret nonce through timing discrepancies, which could potentially allow an attacker to recover the private key after collecting many signing time measurements. The issue mainly affects curves like brainpoolP384r1 and other generic prime curves but does not affect the NIST curves P-256, P-384, and P-521, which have dedicated constant-time implementations. The vulnerability has a low CVSS score and no known exploits in the wild. Fixed versions are available across affected OpenSSL releases.
CVE-2026-35189 is a vulnerability in OpenSSL where a certificate containing many nameRelativeToCRLIssuer CRL distribution points causes excessive heap memory growth during caching of X.509 extensions. This can lead to significant memory pressure and potential denial of service in clients or servers that request client certificates. The issue affects multiple OpenSSL versions prior to fixed releases. The fix delays processing of the CRL distribution points until needed, reducing memory usage.
Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC 9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3 times the amount of data received from the peer address, until such time as the TLS handshake is completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A remote peer may, after establishing a connection with an initial client hello frame, send a subsequent datagram containing multiple QUIC packets, leading the server to account the entire datagram length for each packet in the datagram, resulting in the server believing that the peer has sent more data than it actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.
A timing and cache side-channel vulnerability affects SM2 private key operations on ARM64 and RISC-V platforms in certain OpenSSL versions used by Node.js. The scalar point multiplication implementation is not constant-time, which could allow attackers measuring timing or cache patterns during SM2 signing or decryption to gain information about secret scalars. This vulnerability impacts OpenSSL versions 4.0, 3.6, 3.5, and 3.4 but does not affect versions 3.0, 1.1.1, or 1.0.2. Fixes have been released in OpenSSL 4.0.3, 3.6.5, 3.5.9, and 3.4.8. The CVSS score is 3.7, indicating low severity.
A vulnerability in Node.js TLS server occurs when SSL_set_SSL_CTX() is called to switch a SSL_CTX during a handshake and the new context has more provider signature algorithms than the original. This can cause out-of-bounds memory access leading to a denial of service. The issue affects only non-default configurations where SSL_CTX is switched mid-handshake with differing signature algorithms. FIPS modules are not impacted. The severity is low due to limited exploitation scope and the need for specific application behavior.
A vulnerability in the Node.js OpenSSL QUIC stack allows a remote attacker to flood the local QUIC implementation with NEW_CONNECTION_ID frames by bypassing limits on connection IDs. This leads to excessive memory allocation (~400MB) due to improper handling of RETIRE_CONNECTION_ID frames, violating RFC 9000 requirements. The flaw affects multiple Node.js versions and has a CVSS score of 7.5. A patch is available to address this issue.
CVE-2026-14456 is a vulnerability in OpenSSL's QUIC server implementation introduced in version 3.5. The server allocates resources for new QUIC connections without enforcing limits, allowing an attacker to cause unbounded memory growth by sending many valid Initial packets with unknown connection IDs. This can lead to denial of service by exhausting memory resources. The issue is fixed by introducing a default limit of 256 pending connections, configurable by the application.
CVE-2026-54876 is a memory leak vulnerability in OpenSSL versions 4.0.0 and 3.6.0 affecting TLS clients that enable OCSP response checking. A malicious TLS server can send an OCSP response with no single response entries, causing the client to leak memory during certificate chain verification. This can lead to denial of service by exhausting memory over repeated connections. The vulnerability does not affect OpenSSL FIPS modules and OCSP checking is not enabled by default.
CVE-2025-9232 is an out-of-bounds read vulnerability in the OpenSSL HTTP client API functions triggered when the 'no_proxy' environment variable is set and the HTTP URL host is an IPv6 address. This flaw can cause application crashes leading to denial of service. The vulnerability affects specific OpenSSL patch releases starting from 3.0.16 through 3.5.0. The FIPS modules are not affected. The issue requires an attacker-controlled URL and the presence of the 'no_proxy' environment variable, resulting in a low likelihood of exploitation and assessed as medium severity.
CVE-2025-9231 is a timing side-channel vulnerability in the SM2 algorithm implementation on 64-bit ARM platforms in OpenSSL versions 3.2.0, 3.3.0, 3.4.0, and 3.5.0. This flaw could potentially allow an attacker to recover the private key by analyzing timing variations during signature computations. The vulnerability is considered moderate severity and does not affect OpenSSL's FIPS modules or typical TLS usage since SM2 certificates are not directly supported in TLS by default. Exploitation over a network has not been demonstrated but remains a theoretical risk if custom providers add SM2 support.
CVE-2025-9230 is an out-of-bounds read and write vulnerability in OpenSSL's CMS password-based encryption handling. It can cause application crashes leading to denial of service or memory corruption that might allow code execution. The vulnerability affects several OpenSSL versions but not the FIPS modules. Exploitation likelihood is low due to rare use of the affected feature. The issue is rated as high severity with a CVSS score of 7.5.
OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL
to crash leading to a potential Denial of Service attack
Impact summary: Applications loading files in the PKCS12 format from untrusted
sources might terminate abruptly.
A file in PKCS12 format can contain certificates and keys and may come from an
untrusted source. The PKCS12 specification allows certain fields to be NULL, but
OpenSSL does not correctly check for this case. This can lead to a NULL pointer
dereference that results in OpenSSL crashing. If an application processes PKCS12
files from an untrusted source using the OpenSSL APIs then that application will
be vulnerable to this issue.
OpenSSL APIs that are vulnerable to this are: PKCS12_parse(),
PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()
and PKCS12_newpass().
We have also fixed a similar issue in SMIME_write_PKCS7(). However since this
function is related to writing data we do not consider it security significant.
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.
CVE-2024-12797 is a vulnerability in OpenSSL versions 3.2.0, 3.3.0, and 3.4.0 affecting TLS and DTLS connections that use RFC7250 Raw Public Keys (RPKs) for server authentication. Clients that enable RPKs and rely on SSL_VERIFY_PEER verification mode may fail to detect server authentication failures because the handshake does not abort as expected. This can allow man-in-the-middle attacks if the client does not explicitly check the verification result. The issue does not affect OpenSSL FIPS modules and only arises when RPKs are explicitly enabled by both client and server.
CVE-2024-13176 is a timing side-channel vulnerability in OpenSSL's ECDSA signature computation affecting certain versions including 3.4.0 through 1.0.2. The flaw allows an attacker with local access or a very low-latency network connection to potentially recover the private key by measuring timing differences around 300 nanoseconds. The issue notably affects the NIST P-521 elliptic curve. The severity is rated as medium due to the difficulty of exploitation and limited impact.
CVE-2024-4741 is a use-after-free vulnerability in OpenSSL affecting specific versions including 3.3.0, 3.2.0, 3.1.0, 3.0.0, and 1.1.1. The flaw occurs when the SSL_free_buffers function is called while the internal buffer is still in use, potentially leading to memory corruption, crashes, or arbitrary code execution. This function is rarely used by applications, and the FIPS modules are not affected. No active exploitation is known.
CVE-2024-9143 is an out-of-bounds read and write vulnerability in OpenSSL's low-level GF(2^m) elliptic curve APIs when used with untrusted explicit field polynomial values. This can cause application crashes and potentially remote code execution, but only in rare cases involving exotic curve encodings. Standard protocols using named curves or X9.62 encoding for ECC keys in X.509 certificates are not affected. The FIPS modules are also unaffected.
CVE-2024-5535 is an out-of-bounds read vulnerability in the OpenSSL function SSL_select_next_proto. This occurs when the function is called with an empty client protocols buffer, potentially causing a crash or leaking up to 255 bytes of arbitrary private memory data to the peer. The issue mainly affects applications that incorrectly call this function with a zero-length client protocol list, which is typically a configuration or programming error. The vulnerability is considered low severity by OpenSSL due to limited exploitability and the requirement of application misconfiguration. No patches have been released yet, but a fix is planned for future OpenSSL releases.