OpenSSL vulnerabilities and threats

Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce length via EVP_CipherInit_ex() may trigger a heap out-of-bounds read. Supplying a longer IV is silently truncated instead of rejected. Impact summary: An application passing a caller-supplied IV of the wrong length may crash or read beyond its buffer. Because trailing IV bytes are ignored, an attacker who knows one message and tag may forge messages under a different IV. CWE: CWE-125: Out-of-bounds Read Description: AES-GCM-SIV copies the caller-supplied IV or nonce into its internal state using a copy whose length is taken from the expected nonce size rather than from the length the caller actually provided. When the caller passes a shorter IV, the copy reads past the end of the caller's buffer; AddressSanitizer confirms a heap out-of-bounds read reached through EVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a longer IV, the implementation silently discards the trailing bytes instead of rejecting the length. The truncation breaks the binding between the IV and the computed authentication tag. An attacker who has observed a message and its tag under one IV can produce a message and tag that verify under a different IV whose first bytes match, since the surplus bytes never influence the computation. The message itself is unchanged, so this is a failure of IV commitment rather than a classic existential forgery. Only applications that call EVP_CipherInit_ex() (or the equivalent provider cipher initialization) with an IV length other than the standard 12 bytes for AES-GCM-SIV are affected. The severity is limited because the out-of-bounds read is small and attacker-controlled only in length, and the forgery requires an unusual IV length choice by the application. FIPS impact: no The FIPS modules are not affected by this issue, as AES-GCM-SIV is not an approved algorithm.

Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage while the TLS record layer retains a direct pointer into that storage causing use after free. Impact summary: A malicious QUIC server can cause a heap-use-after-free read in the OpenSSL QUIC client. The server can also identify one allocator-adjacent byte through the client's protected Handshake response. CWE: CWE-416: Use After Free Description: During CRYPTO stream processing, a pointer into the first frame's memory on the stream is lent to the TLS handshake processing. The memory must remain stable until it is processed and released. However the processing of retransmitted CRYPTO frames could release the memory if the retransmitted frame fully overlapped the existing frame. This then causes use-after-free read when the TLS handshake processing continues. The use-after-free read can lead to a Denial-of-Service of the client application or a minor leak of information about the heap memory contents that might be overwritten with other data, subsequently allocated by the application, to the peer. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.

Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supplied so far, instead of leaving the AAD unchanged. An application that supplies its AAD in several fragments, one of which is empty, therefore produces or verifies messages whose authentication tag does not cover the AAD supplied before the empty fragment. Impact summary: Data an application intended to authenticate alongside a message is silently left unauthenticated. An attacker can forge the AAD of such a message. CWE: CWE-325: Missing Cryptographic Step Description: An application passing AAD in multiple chunks of which some have zero length will have the previous AAD chunks effectively unauthenticated. Also, on context re-initialisation, the AAD was not reset, which meant that any AAD accumulated from the previous context usage were also included in the AAD of the new message. The fix makes a zero-length AAD update a no-op and clears any accumulated AAD whenever the context is re-initialised with a key or a nonce. A re-initialisation that only changes parameters keeps the AAD. FIPS impact: no The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved algorithm and is implemented only in the default provider, outside the OpenSSL FIPS module boundary.

Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak into the received address which is then used as the destination for outgoing packets. Impact summary: Applications using QUIC's automated peer detection mechanism may receive an invalid address, leading to connection loss and disclosure of uninitialized stack data to an attacker observing the outgoing network traffic. CWE: CWE-457 (Use of Uninitialized Variable) Description: The OpenSSL QUIC stack contains a feature in which, when using an already connected socket, it will auto-detect the peer address during the SSL handshake. This feature uses the getpeername() function, passing a buffer of sufficient length to hold any supported address family, but passes a buffer length that is only sized such that larger addresses, such as IPv6, cannot be retrieved. The getpeername() function however, still returns the full address length, which is accepted as the valid input buffer length, leading to the address buffer containing uninitialized stack data instead of the actual peer address. The invalid peer address is then used as destination for the outgoing packets which leads to a connectivity breakage and a leakage of the uninitialized stack data to passive network observers. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected protocol is not implemented in the FIPS module.

Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely. Impact summary: An attacker able to supply the recipient certificate to an application performing CMS encryption can cause that application to loop indefinitely, consuming CPU and resulting in Denial of Service. CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') Description: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or more recipient certificates and, for an EC recipient, generate an ephemeral key in the recipient's group. If the certificate declares a group order of 1, random scalar generation can only produce zero. The key generation routine then retries without limit while waiting for a nonzero private scalar, so the call never returns. The OpenSSL TLS and QUIC implementations do not use this path. An application is exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient certificate whose EC parameters are attacker-controlled. Certificates with normal EC group orders do not trigger the loop. OpenSSL 4.0 and later reject unknown explicit EC groups in default builds. These versions are affected only when configured with the enable-ec_explicit_curves option. The result is a hang that consumes a CPU core until the process is interrupted, a Denial of Service. The severity is Low because the attacker must supply the recipient certificate and the application must choose to encrypt to it; ordinary CMS encryption to trusted recipients is unaffected. The fix makes EC key generation fail when the group has no valid nonzero private scalar, instead of retrying indefinitely. FIPS impact: no The FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider does not support arbitrary explicit EC domain parameters, so an order-1 group is rejected during key import before the vulnerable key generation path is reached.

CVE-2026-84782 is an out-of-bounds read vulnerability in OpenSSL's DTLS retransmission logic. It occurs when a handshake message write is suspended mid-message and a retransmission is triggered, causing the retransmitted message to read beyond its buffer. This can disclose heap memory as plaintext handshake data or cause a crash leading to denial of service. The issue affects multiple OpenSSL versions prior to fixed releases. The vulnerability has a high severity with a CVSS score of 8.2.

CVE-2026-77696 is a timing side-channel vulnerability in OpenSSL's SM2 signature generation. The signature computation uses variable-time arithmetic on secret values, allowing an attacker who can measure signing times to gain information about the secret nonce. Over many signatures, this can lead to private key recovery via lattice or Hidden Number Problem attacks. This affects all platforms running vulnerable OpenSSL versions. The vulnerability has a low CVSS score and does not impact FIPS compliance as SM2 is not a FIPS algorithm. Fixed versions are available.

CVE-2026-75806 is a vulnerability in OpenSSL's handling of DTLS 1.2 associations using AEAD cipher suites. An attacker can send a specially crafted datagram with an encrypted fragment shorter than the required explicit IV and authentication tag overhead, causing the targeted DTLS association to be terminated. This results in a denial of service limited to the affected association without impacting memory safety or confidentiality. The issue arises because the record length is not properly validated before AEAD processing, leading to an internal error alert rather than the expected authentication failure alert. The vulnerability affects multiple OpenSSL versions prior to fixed releases.

CVE-2026-75805 is a vulnerability in OpenSSL CMP clients that causes a NULL pointer dereference when processing a crafted certificate revocation response based on a PKCS#10 CSR. This leads to a crash and denial of service. The flaw occurs because the client lacks issuer name and serial number information to validate the server's response, resulting in a read from a NULL pointer. Only clients using PKCS#10 CSR for revocation requests are affected. The issue requires a malicious or compromised CMP server or a man-in-the-middle with message protection keys. No FIPS modules are affected.

CVE-2026-54872 is a timing side-channel vulnerability in OpenSSL's generic elliptic-curve scalar multiplication implementation used for ECDSA and SM2 signature operations on certain curves without dedicated constant-time code. The vulnerability leaks information about the secret nonce through timing discrepancies, which could potentially allow an attacker to recover the private key after collecting many signing time measurements. The issue mainly affects curves like brainpoolP384r1 and other generic prime curves but does not affect the NIST curves P-256, P-384, and P-521, which have dedicated constant-time implementations. The vulnerability has a low CVSS score and no known exploits in the wild. Fixed versions are available across affected OpenSSL releases.

CVE-2026-35189 is a vulnerability in OpenSSL where a certificate containing many nameRelativeToCRLIssuer CRL distribution points causes excessive heap memory growth during caching of X.509 extensions. This can lead to significant memory pressure and potential denial of service in clients or servers that request client certificates. The issue affects multiple OpenSSL versions prior to fixed releases. The fix delays processing of the CRL distribution points until needed, reducing memory usage.

CVE-2026-14456 is a vulnerability in OpenSSL's QUIC server implementation introduced in version 3.5. The server allocates resources for new QUIC connections without enforcing limits, allowing an attacker to cause unbounded memory growth by sending many valid Initial packets with unknown connection IDs. This can lead to denial of service by exhausting memory resources. The issue is fixed by introducing a default limit of 256 pending connections, configurable by the application.

CVE-2026-54876 is a memory leak vulnerability in OpenSSL versions 4.0.0 and 3.6.0 affecting TLS clients that enable OCSP response checking. A malicious TLS server can send an OCSP response with no single response entries, causing the client to leak memory during certificate chain verification. This can lead to denial of service by exhausting memory over repeated connections. The vulnerability does not affect OpenSSL FIPS modules and OCSP checking is not enabled by default.

CVE-2025-15467 is a stack buffer overflow vulnerability in OpenSSL versions 3.0.0 through before 3.0.19, 3.3.0 through before 3.3.6, 3.4.0 through before 3.4.4, 3.5.0 through before 3.5.5, and 3.6.0 through before 3.6.1. It occurs when parsing CMS AuthEnvelopedData or EnvelopedData messages with maliciously crafted AEAD parameters, specifically an oversized Initialization Vector (IV) in ASN.1 parameters copied into a fixed-size stack buffer without length verification. This can cause a stack-based out-of-bounds write before any authentication, potentially leading to denial of service or remote code execution. The vulnerability does not affect OpenSSL 1.1.1 or 1.0.2, nor the FIPS modules 3.0 through 3.6.1. Exploitability depends on platform and mitigations. Red Hat notes that stack protections mitigate code execution risk but denial of service remains possible. Fixed versions are available.

CVE-2025-9232 is an out-of-bounds read vulnerability in the OpenSSL HTTP client API functions triggered when the 'no_proxy' environment variable is set and the HTTP URL host is an IPv6 address. This flaw can cause application crashes leading to denial of service. The vulnerability affects specific OpenSSL patch releases starting from 3.0.16 through 3.5.0. The FIPS modules are not affected. The issue requires an attacker-controlled URL and the presence of the 'no_proxy' environment variable, resulting in a low likelihood of exploitation and assessed as medium severity.

CVE-2025-9231 is a timing side-channel vulnerability in the SM2 algorithm implementation on 64-bit ARM platforms in OpenSSL versions 3.2.0, 3.3.0, 3.4.0, and 3.5.0. This flaw could potentially allow an attacker to recover the private key by analyzing timing variations during signature computations. The vulnerability is considered moderate severity and does not affect OpenSSL's FIPS modules or typical TLS usage since SM2 certificates are not directly supported in TLS by default. Exploitation over a network has not been demonstrated but remains a theoretical risk if custom providers add SM2 support.

CVE-2025-9230 is an out-of-bounds read and write vulnerability in OpenSSL's CMS password-based encryption handling. It can cause application crashes leading to denial of service or memory corruption that might allow code execution. The vulnerability affects several OpenSSL versions but not the FIPS modules. Exploitation likelihood is low due to rare use of the affected feature. The issue is rated as high severity with a CVSS score of 7.5.

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.

CVE-2024-12797 is a vulnerability in OpenSSL versions 3.2.0, 3.3.0, and 3.4.0 affecting TLS and DTLS connections that use RFC7250 Raw Public Keys (RPKs) for server authentication. Clients that enable RPKs and rely on SSL_VERIFY_PEER verification mode may fail to detect server authentication failures because the handshake does not abort as expected. This can allow man-in-the-middle attacks if the client does not explicitly check the verification result. The issue does not affect OpenSSL FIPS modules and only arises when RPKs are explicitly enabled by both client and server.

CVE-2024-13176 is a timing side-channel vulnerability in OpenSSL's ECDSA signature computation affecting certain versions including 3.4.0 through 1.0.2. The flaw allows an attacker with local access or a very low-latency network connection to potentially recover the private key by measuring timing differences around 300 nanoseconds. The issue notably affects the NIST P-521 elliptic curve. The severity is rated as medium due to the difficulty of exploitation and limited impact.