OP
Product
OpenSSL
On CISA KEVExploited in the wild
318
CVEs
1
On KEV
9.8
Max CVSS
14
New 30D
Severity mix
Critical 17High 87Medium 75Low 13
Watch
Add OpenSSL to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-1543 | 7.4 | Mar 6 | ChaCha20-Poly1305 with long nonces Affected: Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b); Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j) |
| CVE-2014-0224 | 7.4 | Jun 5 | OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers… Affected: before 0.9.8za; 1.0.0 before 1.0.0m; 1.0.1 before 1.0.1h |
| CVE-2022-2068 | 7.3 | Jun 21 | The c_rehash script allows command injection Affected: Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3); Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o); Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze) |
| CVE-2022-1292 | 7.3 | May 3 | The c_rehash script allows command injection Affected: Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2); Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n); Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd) |
| CVE-2026-2673 | 6.5 | Mar 13 | OpenSSL TLS 1.3 server may choose unexpected key agreement group Affected: 3.6.0 before 3.6.2; 3.5.0 before 3.5.6 |
| CVE-2025-9231 | 6.5 | Sep 30 | Timing side-channel in SM2 algorithm on 64 bit ARM Affected: 3.5.0 before 3.5.4; 3.4.0 before 3.4.3; 3.3.0 before 3.3.5; 3.2.0 before 3.2.6 |
| CVE-2025-4575 | 6.5 | May 22 | Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate Affected: 3.5.0 |
| CVE-2023-6129 | 6.5 | Jan 9 | POLY1305 MAC implementation corrupts vector registers on PowerPC Affected: 3.2.0 before 3.2.1; 3.1.0 before 3.1.5; 3.0.0 before 3.0.13 |
| CVE-2023-2650 | 6.5 | May 30 | Possible DoS translating ASN.1 object identifiers Affected: 3.1.1 before 3.1.1; 3.0.0 before 3.0.9; 1.1.1 before 1.1.1u; 1.0.2 before 1.0.2zh |
| CVE-2018-0739 | 6.5 | Mar 27 | Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion Affected: 1.0.2b through 1.0.2n; 1.1.0 through 1.1.0g |
| CVE-2017-3736 | 6.5 | Nov 2 | There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g Affected: 1.0.2 before 1.0.2m; 1.1.0 before 1.1.0g |
| CVE-2015-1793 | 6.5 | Jul 9 | The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during… Affected: 1.0.1n; 1.0.1o; 1.0.2b; 1.0.2c |
| CVE-2026-42771 | 6.2 | Jun 9 | Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email() Affected: 4.0.0 before 4.0.1 |
| CVE-2025-11187 | 6.1 | Jan 27 | Improper validation of PBMAC1 parameters in PKCS#12 MAC verification Affected: 3.6.0 before 3.6.1; 3.5.0 before 3.5.5; 3.4.0 before 3.4.4 |
| CVE-2026-63074 | 5.9 | Aug 25 | CMP Indefinite Cache Growth of ExtraCerts Affected: 4.0.0 before 4.0.2; 3.6.0 before 3.6.4; 3.5.0 before 3.5.8; 3.4.0 before 3.4.7; 3.0.0 before 3.0.22 |
| CVE-2026-42767 | 5.9 | Jun 9 | NULL Pointer Dereference in CRMF EncryptedValue Decryption Affected: 4.0.0 before 4.0.1; 3.6.0 before 3.6.3; 3.5.0 before 3.5.7; 3.4.0 before 3.4.6; 3.0.0 before 3.0.21 |
| CVE-2026-42766 | 5.9 | Jun 9 | Possible NULL Dereference in Password-Based CMS Decryption Affected: 4.0.0 before 4.0.1; 3.6.0 before 3.6.3; 3.5.0 before 3.5.7; 3.4.0 before 3.4.6; 3.0.0 before 3.0.21; 1.1.1 before 1.1.1zh; +1 more |
| CVE-2025-66199 | 5.9 | Jan 27 | TLS 1.3 CompressedCertificate excessive memory allocation Affected: 3.6.0 before 3.6.1; 3.5.0 before 3.5.5; 3.4.0 before 3.4.4; 3.3.0 before 3.3.6 |
| CVE-2025-15468 | 5.9 | Jan 27 | NULL dereference in SSL_CIPHER_find() function on unknown cipher ID Affected: 3.6.0 before 3.6.1; 3.5.0 before 3.5.5; 3.4.0 before 3.4.4; 3.3.0 before 3.3.6 |
| CVE-2025-9232 | 5.9 | Sep 30 | Out-of-bounds read in HTTP client no_proxy handling Affected: 3.5.0 before 3.5.4; 3.4.0 before 3.4.3; 3.3.3 before 3.3.5; 3.2.4 before 3.2.6; 3.0.16 before 3.0.18 |
| CVE-2023-6237 | 5.9 | Apr 25 | Excessive time spent checking invalid RSA public keys Affected: 3.0.0 before 3.0.13; 3.1.0 before 3.1.5; 3.2.0 before 3.2.1 |
| CVE-2024-2511 | 5.9 | Apr 8 | Unbounded memory growth with session handling in TLSv1.3 Affected: 3.2.0 before 3.2.2; 3.1.0 before 3.1.6; 3.0.0 before 3.0.14; 1.1.1 before 1.1.1y |
| CVE-2023-1255 | 5.9 | Apr 20 | Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash Affected: 3.0.0 before 3.0.9; 3.1.0 before 3.1.1 |
| CVE-2022-4304 | 5.9 | Feb 8 | Timing Oracle in RSA Decryption Affected: 3.0.0 before 3.0.8; 1.1.1 before 1.1.1t; 1.0.2 before 1.0.2zg |
| CVE-2022-1434 | 5.9 | May 3 | Incorrect MAC key used in the RC4-MD5 ciphersuite Affected: Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2) |
| CVE-2021-4160 | 5.9 | Jan 28 | There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure Affected: 1.0.2 through 1.0.2zb; 1.1.1 before 1.1.1m; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +16 more |
| CVE-2021-3449 | 5.9 | Mar 25 | NULL pointer deref in signature_algorithms processing Affected: Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j) |
| CVE-2021-23841 | 5.9 | Feb 16 | The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509… Affected: 1.0.2 before 1.0.2y; 1.1.1 before 1.1.1j |
| CVE-2020-1971 | 5.9 | Dec 8 | The X.509 GeneralName type is a generic type for representing different types of names Affected: 1.0.2 before 1.0.2x; 1.1.1 before 1.1.1i |
| CVE-2019-1559 | 5.9 | Feb 27 | 0-byte record padding oracle Affected: Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q) |
| CVE-2018-0734 | 5.9 | Oct 30 | Timing attack against DSA Affected: Fixed in OpenSSL 1.1.1a (Affected 1.1.1); Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i); Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p) |
| CVE-2018-0735 | 5.9 | Oct 29 | Timing attack against ECDSA signature generation Affected: Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i); Fixed in OpenSSL 1.1.1a (Affected 1.1.1) |
| CVE-2018-0737 | 5.9 | Apr 16 | Cache timing vulnerability in RSA Key Generation Affected: Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h); Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o) |
| CVE-2018-0733 | 5.9 | Mar 27 | Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte Affected: 1.1.0 through 1.1.0g |
| CVE-2017-3738 | 5.9 | Dec 7 | There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli Affected: 1.0.2; 1.0.2; 1.0.2; 1.0.2; 1.0.2a; 1.0.2b; +19 more |
| CVE-2017-3737 | 5.9 | Dec 7 | OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism Affected: 1.0.2b; 1.0.2c; 1.0.2d; 1.0.2e; 1.0.2f; 1.0.2g; +6 more |
| CVE-2016-7055 | 5.9 | May 4 | There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure in OpenSSL 1.0.2 and 1.1.0 before 1.1.0c that handles input lengths divisible by,… Affected: 1.0.2 before 1.0.2k; 1.1.0 before 1.1.0c |
| CVE-2017-3732 | 5.9 | May 4 | There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d Affected: 1.0.2; 1.0.2; 1.0.2; 1.0.2; 1.0.2a; 1.0.2b; +9 more |
| CVE-2016-6308 | 5.9 | Sep 26 | statem/statem_dtls.c in the DTLS implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow remote attackers to… Affected: 1.1.0 |
| CVE-2016-6307 | 5.9 | Sep 26 | The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow remote attackers to cause a denial of… Affected: 1.1.0 |
| CVE-2016-6306 | 5.9 | Sep 26 | The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate… Affected: 1.0.1; 1.0.1; 1.0.1; 1.0.1; 1.0.1a; 1.0.1b; +29 more |
| CVE-2016-2107 | 5.9 | May 5 | The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to… Affected: through 1.0.1s; 1.0.2; 1.0.2; 1.0.2; 1.0.2; 1.0.2a; +6 more |
| CVE-2016-0704 | 5.9 | Mar 2 | An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m,… Affected: through 0.9.8ze; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +34 more |
| CVE-2016-0703 | 5.9 | Mar 2 | The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a… Affected: through 0.9.8ze; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +34 more |
| CVE-2016-0800 | 5.9 | Mar 1 | The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client… Affected: 1.0.1; 1.0.1; 1.0.1; 1.0.1; 1.0.1a; 1.0.1b; +26 more |
| CVE-2015-3197 | 5.9 | Feb 15 | ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat… Affected: 1.0.1; 1.0.1; 1.0.1; 1.0.1; 1.0.1a; 1.0.1b; +24 more |
| CVE-2026-22795 | 5.5 | Jan 27 | Missing ASN1_TYPE validation in PKCS#12 parsing Affected: 3.6.0 before 3.6.1; 3.5.0 before 3.5.5; 3.4.0 before 3.4.4; 3.3.0 before 3.3.6; 3.0.0 before 3.0.19; 1.1.1 before 1.1.1ze |
| CVE-2025-15469 | 5.5 | Jan 27 | 'openssl dgst' one-shot codepath silently truncates inputs >16MB Affected: 3.6.0 before 3.6.1; 3.5.0 before 3.5.5 |
| CVE-2024-0727 | 5.5 | Jan 26 | PKCS12 Decoding crashes Affected: 3.2.0 before 3.2.1; 3.1.0 before 3.1.5; 3.0.0 before 3.0.13; 1.1.1 before 1.1.1x; 1.0.2 before 1.0.2zj |
| CVE-2016-7056 | 5.5 | Sep 10 | A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys Affected: through 1.0.1u |