# OpenSSL. Every CVE that names OpenSSL among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [QUIC: Unbounded RETIRE_CONNECTION_ID Backlog](https://agentprime.io/advisories/CVE-2026-84784.md) `CVE-2026-84784` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: Denial of service - [Use-After-Free in X.509 Extension Cache Under Concurrent Use](https://agentprime.io/advisories/CVE-2026-84783.md) `CVE-2026-84783` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption - [DTLS Retransmits Handshake Messages From a Stale Buffer Offset](https://agentprime.io/advisories/CVE-2026-84782.md) `CVE-2026-84782` · CVE record: OpenSSL OpenSSL · CVSS 8.2 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption - [Timing Side-Channel in SM2 Signature Generation](https://agentprime.io/advisories/CVE-2026-77696.md) `CVE-2026-77696` · CVE record: OpenSSL OpenSSL · CVSS 3.7 Low · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-208 - [Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS](https://agentprime.io/advisories/CVE-2026-75806.md) `CVE-2026-75806` · CVE record: OpenSSL OpenSSL · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-1284 - [NULL Pointer Dereference in CMP Client Revocation Response Handling](https://agentprime.io/advisories/CVE-2026-75805.md) `CVE-2026-75805` · CVE record: OpenSSL OpenSSL · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption - [QUIC Connection-Level Flow Control is Not Enforced for Streams](https://agentprime.io/advisories/CVE-2026-75804.md) `CVE-2026-75804` · CVE record: OpenSSL OpenSSL · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Denial of service - [Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake](https://agentprime.io/advisories/CVE-2026-72897.md) `CVE-2026-72897` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption - [Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V](https://agentprime.io/advisories/CVE-2026-54875.md) `CVE-2026-54875` · CVE record: OpenSSL OpenSSL · CVSS 3.7 Low · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-208 - [QUIC STREAM Fragment Metadata DoS](https://agentprime.io/advisories/CVE-2026-54873.md) `CVE-2026-54873` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: Denial of service - [Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves](https://agentprime.io/advisories/CVE-2026-54872.md) `CVE-2026-54872` · CVE record: OpenSSL OpenSSL · CVSS 3.7 Low · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-208 - [Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC](https://agentprime.io/advisories/CVE-2026-42772.md) `CVE-2026-42772` · CVE record: OpenSSL OpenSSL · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Denial of service - [QUIC Unvalidated Amplification Credit may be Over Accounted](https://agentprime.io/advisories/CVE-2026-35191.md) `CVE-2026-35191` · CVE record: OpenSSL OpenSSL · CVSS 3.7 Low · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-440 - [Excessive Memory Allocation in Relative CRLDP Processing](https://agentprime.io/advisories/CVE-2026-35189.md) `CVE-2026-35189` · CVE record: OpenSSL OpenSSL · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Denial of service - [AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()](https://agentprime.io/advisories/CVE-2026-75803.md) `CVE-2026-75803` · CVE record: OpenSSL OpenSSL · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-354 - [Invalid Pointer Dereference in CMP Server via Crafted protectionAlg](https://agentprime.io/advisories/CVE-2026-63076.md) `CVE-2026-63076` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [QUIC ACK-only Packet Retention Can Cause Memory Exhaustion](https://agentprime.io/advisories/CVE-2026-63075.md) `CVE-2026-63075` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service - [CMP Indefinite Cache Growth of ExtraCerts](https://agentprime.io/advisories/CVE-2026-63074.md) `CVE-2026-63074` · CVE record: OpenSSL OpenSSL · CVSS 5.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service - [Untrusted Sender DN Used as Format String in CMP Response Validation](https://agentprime.io/advisories/CVE-2026-63073.md) `CVE-2026-63073` · CVE record: OpenSSL OpenSSL · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [Heap Buffer Overflow in CMS Key Unwrapping](https://agentprime.io/advisories/CVE-2026-63072.md) `CVE-2026-63072` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [Excessive Memory Use Buffering DTLS Records for a Future Epoch](https://agentprime.io/advisories/CVE-2026-54874.md) `CVE-2026-54874` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-405 - [QUIC Server May Trigger Double Free When Processing INITIAL Packet](https://agentprime.io/advisories/CVE-2026-18798.md) `CVE-2026-18798` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate](https://agentprime.io/advisories/CVE-2026-14457.md) `CVE-2026-14457` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption - [Unbounded Memory Growth in QUIC Server Incoming Channel Queue](https://agentprime.io/advisories/CVE-2026-14456.md) `CVE-2026-14456` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Client-Side Memory Leak in OCSP Response Checking](https://agentprime.io/advisories/CVE-2026-54876.md) `CVE-2026-54876` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: Denial of service - [Heap Use-After-Free in the PKCS7_verify() Function](https://agentprime.io/advisories/CVE-2026-45447.md) `CVE-2026-45447` · CVE record: OpenSSL OpenSSL · CVSS 8.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption - [Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes](https://agentprime.io/advisories/CVE-2026-45446.md) `CVE-2026-45446` · CVE record: OpenSSL OpenSSL · CVSS 4.8 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-325 - [AES-OCB IV Ignored on EVP_Cipher() Path](https://agentprime.io/advisories/CVE-2026-45445.md) `CVE-2026-45445` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-325 - [Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()](https://agentprime.io/advisories/CVE-2026-42771.md) `CVE-2026-42771` · CVE record: OpenSSL OpenSSL · CVSS 6.2 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption - [FFC-DH Peer Validation Uses Attacker-Supplied q](https://agentprime.io/advisories/CVE-2026-42770.md) `CVE-2026-42770` · CVE record: OpenSSL OpenSSL · CVSS 3.7 Low · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-325 - [Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate](https://agentprime.io/advisories/CVE-2026-42769.md) `CVE-2026-42769` · CVE record: OpenSSL OpenSSL · CVSS 5.3 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Weak cryptography or TLS - [Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()](https://agentprime.io/advisories/CVE-2026-42768.md) `CVE-2026-42768` · CVE record: OpenSSL OpenSSL · CVSS 3.7 Low · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-514 - [NULL Pointer Dereference in CRMF EncryptedValue Decryption](https://agentprime.io/advisories/CVE-2026-42767.md) `CVE-2026-42767` · CVE record: OpenSSL OpenSSL · CVSS 5.9 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption - [Possible NULL Dereference in Password-Based CMS Decryption](https://agentprime.io/advisories/CVE-2026-42766.md) `CVE-2026-42766` · CVE record: OpenSSL OpenSSL · CVSS 5.9 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption - [NULL Dereference in Certificate Verification with OCSP Checking](https://agentprime.io/advisories/CVE-2026-42765.md) `CVE-2026-42765` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption - [NULL Pointer Dereference in QUIC Server Initial Packet Handling](https://agentprime.io/advisories/CVE-2026-42764.md) `CVE-2026-42764` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption - [Double-free When Checking OCSP Stapled Response](https://agentprime.io/advisories/CVE-2026-35188.md) `CVE-2026-35188` · CVE record: OpenSSL OpenSSL · CVSS 5.0 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption - [Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler](https://agentprime.io/advisories/CVE-2026-34183.md) `CVE-2026-34183` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-1325 - [CMS AuthEnvelopedData Processing May Accept Forged Messages](https://agentprime.io/advisories/CVE-2026-34182.md) `CVE-2026-34182` · CVE record: OpenSSL OpenSSL · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-354 - [PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys](https://agentprime.io/advisories/CVE-2026-34181.md) `CVE-2026-34181` · CVE record: OpenSSL OpenSSL · CVSS 7.4 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-354 - [Heap Buffer Over-read in ASN.1 Content Parsing](https://agentprime.io/advisories/CVE-2026-34180.md) `CVE-2026-34180` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption - [Out-of-Bounds Read in CMS Password-Based Decryption](https://agentprime.io/advisories/CVE-2026-9076.md) `CVE-2026-9076` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption - [Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion](https://agentprime.io/advisories/CVE-2026-7383.md) `CVE-2026-7383` · CVE record: OpenSSL OpenSSL · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption - [Incorrect Failure Handling in RSA KEM RSASVE Encapsulation](https://agentprime.io/advisories/CVE-2026-31790.md) `CVE-2026-31790` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-754 - [Heap Buffer Overflow in Hexadecimal Conversion](https://agentprime.io/advisories/CVE-2026-31789.md) `CVE-2026-31789` · CVE record: OpenSSL OpenSSL · CVSS 5.8 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Memory corruption - [Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo](https://agentprime.io/advisories/CVE-2026-28390.md) `CVE-2026-28390` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 7 Apr 2026 · Tags: Memory corruption - [Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo](https://agentprime.io/advisories/CVE-2026-28389.md) `CVE-2026-28389` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 7 Apr 2026 · Tags: Memory corruption - [NULL Pointer Dereference When Processing a Delta CRL](https://agentprime.io/advisories/CVE-2026-28388.md) `CVE-2026-28388` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 7 Apr 2026 · Tags: Memory corruption - [Potential Use-after-free in DANE Client Code](https://agentprime.io/advisories/CVE-2026-28387.md) `CVE-2026-28387` · CVE record: OpenSSL OpenSSL · CVSS 8.1 High · Not analysed yet · Published 7 Apr 2026 · Tags: Memory corruption - [Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support](https://agentprime.io/advisories/CVE-2026-28386.md) `CVE-2026-28386` · CVE record: OpenSSL OpenSSL · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Apr 2026 · Tags: Memory corruption - [OpenSSL TLS 1.3 server may choose unexpected key agreement group](https://agentprime.io/advisories/CVE-2026-2673.md) `CVE-2026-2673` · CVE record: OpenSSL OpenSSL · CVSS 6.5 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-757 - [ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function](https://agentprime.io/advisories/CVE-2026-22796.md) `CVE-2026-22796` · CVE record: OpenSSL OpenSSL · CVSS 5.3 Medium · Not analysed yet · Published 27 Jan 2026 · Tags: CWE-754 - [Missing ASN1_TYPE validation in PKCS#12 parsing](https://agentprime.io/advisories/CVE-2026-22795.md) `CVE-2026-22795` · CVE record: OpenSSL OpenSSL · CVSS 5.5 Medium · Not analysed yet · Published 27 Jan 2026 · Tags: CWE-754 - [NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function](https://agentprime.io/advisories/CVE-2025-69421.md) `CVE-2025-69421` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 27 Jan 2026 · Tags: Memory corruption - [Missing ASN1_TYPE validation in TS_RESP_verify_response() function](https://agentprime.io/advisories/CVE-2025-69420.md) `CVE-2025-69420` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 27 Jan 2026 · Tags: CWE-754 - [Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion](https://agentprime.io/advisories/CVE-2025-69419.md) `CVE-2025-69419` · CVE record: OpenSSL OpenSSL · CVSS 7.4 High · Not analysed yet · Published 27 Jan 2026 · Tags: Memory corruption - [Unauthenticated/unencrypted trailing bytes with low-level OCB function calls](https://agentprime.io/advisories/CVE-2025-69418.md) `CVE-2025-69418` · CVE record: OpenSSL OpenSSL · CVSS 4.0 Medium · Not analysed yet · Published 27 Jan 2026 · Tags: CWE-325 - [Heap out-of-bounds write in BIO_f_linebuffer on short writes](https://agentprime.io/advisories/CVE-2025-68160.md) `CVE-2025-68160` · CVE record: OpenSSL OpenSSL · CVSS 4.7 Medium · Not analysed yet · Published 27 Jan 2026 · Tags: Memory corruption - [TLS 1.3 CompressedCertificate excessive memory allocation](https://agentprime.io/advisories/CVE-2025-66199.md) `CVE-2025-66199` · CVE record: OpenSSL OpenSSL · CVSS 5.9 Medium · Not analysed yet · Published 27 Jan 2026 · Tags: Denial of service - ['openssl dgst' one-shot codepath silently truncates inputs >16MB](https://agentprime.io/advisories/CVE-2025-15469.md) `CVE-2025-15469` · CVE record: OpenSSL OpenSSL · CVSS 5.5 Medium · Not analysed yet · Published 27 Jan 2026 · Tags: Weak cryptography or TLS Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .