openssl
34 known vulnerabilities affecting openssl products.
Products
Vulnerabilities by priority
| CVE | Priority | EPSS | CVSS | KEV | What |
|---|---|---|---|---|---|
| CVE-2025-15467 | Medium | 48.2% | 8.8 | Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with malic… | |
| CVE-2026-45447 | Medium | 3.6% | 8.8 | Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger… | |
| CVE-2026-63076 | Medium | 1.4% | 7.5 | Issue summary: OpenSSL CMP password based protection verification only checks wh… | |
| CVE-2026-42764 | Medium | 1.2% | 7.5 | Issue summary: Receiving a QUIC initial packet with an invalid token may trigger… | |
| CVE-2026-34183 | Medium | 1.0% | 7.5 | Issue summary: Remote peer may exhaust heap memory of the QUIC server or client … | |
| CVE-2026-31790 | Medium | 1.0% | 7.5 | Issue summary: Applications using RSASVE key encapsulation to establish a secret… | |
| CVE-2026-34180 | Medium | 1.0% | 7.5 | Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive el… | |
| CVE-2026-14457 | Medium | 1.0% | 7.5 | Issue summary: In a server or client configuration with RFC7250 Raw Public Keys … | |
| CVE-2026-63073 | Medium | 0.9% | 9.8 | Issue summary: OpenSSL CMP response validation passed an unexpected response sen… | |
| CVE-2026-28388 | Medium | 0.9% | 7.5 | Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is… | |
| CVE-2026-28389 | Medium | 0.8% | 7.5 | Issue summary: During processing of a crafted CMS EnvelopedData message with Key… | |
| CVE-2026-28390 | Medium | 0.8% | 7.5 | Issue summary: During processing of a crafted CMS EnvelopedData message with Key… | |
| CVE-2026-7383 | Medium | 0.8% | 8.1 | Issue summary: A signed integer overflow when sizing the destination buffer for … | |
| CVE-2026-9076 | Medium | 0.7% | 7.5 | Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) p… | |
| CVE-2026-45445 | Medium | 0.7% | 7.5 | Issue summary: When an application drives an AES-OCB context through the public … | |
| CVE-2026-63072 | Medium | 0.7% | 7.5 | Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based o… | |
| CVE-2026-28387 | Medium | 0.7% | 8.1 | Issue summary: An uncommon configuration of clients performing DANE TLSA-based s… | |
| CVE-2026-34182 | Medium | 0.6% | 9.1 | Issue Summary: Cryptographic Message Services (CMS) processing fails to perform … | |
| CVE-2026-54874 | Medium | 0.5% | 7.5 | Issue summary: Receiving a DTLS record for a future epoch while a handshake is i… | |
| CVE-2026-42765 | Medium | 0.5% | 7.5 | Issue summary: When a partial-chain certificate verification is enabled together… | |
| CVE-2026-63075 | Medium | 0.5% | 7.5 | Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly s… | |
| CVE-2026-28386 | Medium | 0.3% | 7.5 | Issue summary: Applications using AES-CFB128 encryption or decryption on systems… | |
| CVE-2026-31789 | Medium | 0.2% | 9.8 | Issue summary: Converting an excessively large OCTET STRING value to a hexadecim… | |
| CVE-2026-34181 | Medium | 0.2% | 7.4 | Issue Summary: The PKCS#12 file processing fails to perform sufficient input val… | |
| CVE-2026-75803 | Medium | 0.2% | 9.1 | Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext… | |
| CVE-2026-42766 | Low | 1.1% | 5.9 | Issue summary: A specially crafted password-encrypted CMS message can trigger a … | |
| CVE-2026-42768 | Low | 0.6% | 3.7 | Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Ble… | |
| CVE-2026-42767 | Low | 0.6% | 5.9 | Issue summary: An attacker-controlled CMP (Certificate Management Protocol) serv… | |
| CVE-2026-42770 | Low | 0.5% | 3.7 | Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer… | |
| CVE-2026-63074 | Low | 0.5% | 5.9 | Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches addition… | |
| CVE-2026-45446 | Low | 0.4% | 4.8 | Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 84… | |
| CVE-2026-42769 | Low | 0.4% | 5.3 | Issue Summary: An error in the callback used to verify the certificate provided … | |
| CVE-2026-35188 | Low | 0.3% | 5.0 | Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a … | |
| CVE-2026-42771 | Low | 0.2% | 6.2 | Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application… |