Search: CVE-2025-9232

CVE-2025-9232 is an out-of-bounds read vulnerability in the OpenSSL HTTP client API functions triggered when the 'no_proxy' environment variable is set and the HTTP URL host is an IPv6 address. This flaw can cause application crashes leading to denial of service. The vulnerability affects specific OpenSSL patch releases starting from 3.0.16 through 3.5.0. The FIPS modules are not affected. The issue requires an attacker-controlled URL and the presence of the 'no_proxy' environment variable, resulting in a low likelihood of exploitation and assessed as medium severity.