Openssl Security Vulnerabilities (CVEs)
Track 23 security vulnerabilities affecting Openssl products and software. Get instant email alerts when new CVEs are discovered, automated security monitoring, and patch guidance.
This CVE describes a type confusion vulnerability in OpenSSL's PKCS#12 parsing code where an invalid or NULL pointer dereference occurs when processin...
Jan 27, 2026A type confusion vulnerability in OpenSSL's PKCS#7 signature verification allows attackers to cause denial of service by providing malformed signed PK...
Jan 27, 2026This OpenSSL vulnerability allows memory corruption via a malicious PKCS#12 file containing non-ASCII BMP characters in the friendly name field. When ...
Jan 27, 2026A type confusion vulnerability in OpenSSL's TimeStamp Response verification allows attackers to cause denial of service by providing malformed timesta...
Jan 27, 2026A NULL pointer dereference vulnerability in OpenSSL's PKCS12_item_decrypt_d2i_ex() function allows attackers to cause denial of service by providing m...
Jan 27, 2026This vulnerability in OpenSSL's low-level OCB API exposes the last 1-15 bytes of a message in cleartext and unauthenticated when using hardware-accele...
Jan 27, 2026A TLS 1.3 vulnerability in OpenSSL allows attackers to force large memory allocations (up to 22 MiB per connection) via certificate compression, poten...
Jan 27, 2026This vulnerability in OpenSSL's line-buffering BIO filter allows heap-based out-of-bounds writes when processing large, newline-free data with short w...
Jan 27, 2026This vulnerability in OpenSSL allows attackers to cause denial of service or potentially execute arbitrary code by crafting malicious PKCS#12 files th...
Jan 27, 2026A NULL pointer dereference vulnerability in OpenSSL's SSL_CIPHER_find() function when used with QUIC protocol allows denial of service attacks. Applic...
Jan 27, 2026The OpenSSL 'dgst' command-line tool silently truncates files larger than 16MB when using one-shot signing algorithms (Ed25519, Ed448, ML-DSA variants...
Jan 27, 2026This vulnerability allows attackers to trigger a stack buffer overflow by sending maliciously crafted CMS AuthEnvelopedData messages with oversized IV...
Jan 27, 2026A copy-paste error in OpenSSL 3.5 causes the '-addreject' option in the openssl x509 command to incorrectly mark certificates as trusted for specific ...
May 22, 2025A bug in OpenSSL's POLY1305 MAC implementation on Windows 64-bit systems with AVX512-IFMA capable processors can corrupt application state by zeroing ...
Sep 8, 2023This vulnerability allows malicious Certificate Authorities to bypass certificate policy checks by including invalid policies in leaf certificates. Wh...
Mar 28, 2023This OpenSSL vulnerability allows attackers to cause denial-of-service by exploiting certificate policy constraint processing. When enabled, malicious...
Mar 22, 2023This CVE describes a NULL pointer dereference vulnerability in OpenSSL's PKCS7 parsing functions (d2i_PKCS7, d2i_PKCS7_bio, d2i_PKCS7_fp). When applic...
Feb 8, 2023CVE-2023-0286 is a type confusion vulnerability in OpenSSL's X.400 address processing that can cause memory corruption when CRL checking is enabled. A...
Feb 8, 2023A double-free vulnerability in OpenSSL's PEM parsing functions allows attackers to cause denial of service through specially crafted PEM files. The vu...
Feb 8, 2023CVE-2022-1292 is a command injection vulnerability in the c_rehash script distributed with OpenSSL. It allows attackers to execute arbitrary commands ...
May 3, 2022A memory leak vulnerability in OpenSSL's OPENSSL_LH_flush() function causes unbounded memory growth when processing certificates or keys. This affects...
May 3, 2022CVE-2022-0778 is a denial-of-service vulnerability in OpenSSL's BN_mod_sqrt() function that can cause infinite loops when parsing specially crafted ce...
Mar 15, 2022This OpenSSL vulnerability allows attackers to cause buffer overruns when applications directly construct ASN.1 strings without proper NUL termination...
Aug 24, 2021Why Monitor Openssl Security Vulnerabilities?
Real-time CVE tracking: Our automated system monitors 23+ known vulnerabilities affecting Openssl products and software packages. Stay ahead of emerging threats with instant email notifications when new security issues are discovered.
Automated security monitoring: Unlike manual CVE checking, FixTheCVE automatically scans your servers and detects vulnerable Openssl packages in under 60 seconds. No agents required - completely agentless scanning that works across Openssl deployments.
Free vulnerability database: Access detailed information about every Openssl CVE including CVSS scores, severity ratings, affected versions, and actionable patch guidance. Filter by critical, high, medium, or low severity to prioritize your security remediation efforts.
🚀 Get Started in 60 Seconds
- Register free account & add your servers
- Run one-time scan or schedule automatic monitoring (every 1-24 hours)
- Receive instant alerts when new Openssl CVEs affect your systems
- Access dashboard with severity breakdown & fix instructions
