OpenSSL.

QUIC: Unbounded RETIRE_CONNECTION_ID Backlog

• OpenSSL
• Denial of service

Use-After-Free in X.509 Extension Cache Under Concurrent Use

• OpenSSL
• Memory corruption

DTLS Retransmits Handshake Messages From a Stale Buffer Offset

• OpenSSL
• Memory corruption

Timing Side-Channel in SM2 Signature Generation

• OpenSSL
• CWE-208

Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS

• OpenSSL
• CWE-1284

NULL Pointer Dereference in CMP Client Revocation Response Handling

• OpenSSL
• Memory corruption

QUIC Connection-Level Flow Control is Not Enforced for Streams

• OpenSSL
• Denial of service

Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake

• OpenSSL
• Memory corruption

Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V

• OpenSSL
• CWE-208

QUIC STREAM Fragment Metadata DoS

• OpenSSL
• Denial of service

Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves

• OpenSSL
• CWE-208

Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

• OpenSSL
• Denial of service

QUIC Unvalidated Amplification Credit may be Over Accounted

• OpenSSL
• CWE-440

Excessive Memory Allocation in Relative CRLDP Processing

• OpenSSL
• Denial of service

AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()

• OpenSSL
• CWE-354

Invalid Pointer Dereference in CMP Server via Crafted protectionAlg

• OpenSSL
• Memory corruption

QUIC ACK-only Packet Retention Can Cause Memory Exhaustion

• OpenSSL
• Denial of service

CMP Indefinite Cache Growth of ExtraCerts

• OpenSSL
• Denial of service

Untrusted Sender DN Used as Format String in CMP Response Validation

• OpenSSL
• Memory corruption

Heap Buffer Overflow in CMS Key Unwrapping

• OpenSSL
• Memory corruption

Excessive Memory Use Buffering DTLS Records for a Future Epoch

• OpenSSL
• CWE-405

QUIC Server May Trigger Double Free When Processing INITIAL Packet

• OpenSSL
• Memory corruption

RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate

• OpenSSL
• Memory corruption

Unbounded Memory Growth in QUIC Server Incoming Channel Queue

• OpenSSL
• Denial of service

Client-Side Memory Leak in OCSP Response Checking

• OpenSSL
• Denial of service

Heap Use-After-Free in the PKCS7_verify() Function

• OpenSSL
• Memory corruption

Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes

• OpenSSL
• CWE-325

AES-OCB IV Ignored on EVP_Cipher() Path

• OpenSSL
• CWE-325

Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()

• OpenSSL
• Memory corruption

FFC-DH Peer Validation Uses Attacker-Supplied q

• OpenSSL
• CWE-325

Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate

• OpenSSL
• Weak cryptography or TLS

Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()

• OpenSSL
• CWE-514

NULL Pointer Dereference in CRMF EncryptedValue Decryption

• OpenSSL
• Memory corruption

Possible NULL Dereference in Password-Based CMS Decryption

• OpenSSL
• Memory corruption

NULL Dereference in Certificate Verification with OCSP Checking

• OpenSSL
• Memory corruption

NULL Pointer Dereference in QUIC Server Initial Packet Handling

• OpenSSL
• Memory corruption

Double-free When Checking OCSP Stapled Response

• OpenSSL
• Memory corruption

Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

• OpenSSL
• CWE-1325

CMS AuthEnvelopedData Processing May Accept Forged Messages

• OpenSSL
• CWE-354

PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys

• OpenSSL
• CWE-354

Heap Buffer Over-read in ASN.1 Content Parsing

• OpenSSL
• Memory corruption

Out-of-Bounds Read in CMS Password-Based Decryption

• OpenSSL
• Memory corruption

Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion

• OpenSSL
• Memory corruption

Incorrect Failure Handling in RSA KEM RSASVE Encapsulation

• OpenSSL
• CWE-754

Heap Buffer Overflow in Hexadecimal Conversion

• OpenSSL
• Memory corruption

Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

• OpenSSL
• Memory corruption

Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo

• OpenSSL
• Memory corruption

NULL Pointer Dereference When Processing a Delta CRL

• OpenSSL
• Memory corruption

Potential Use-after-free in DANE Client Code

• OpenSSL
• Memory corruption

Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support

• OpenSSL
• Memory corruption

OpenSSL TLS 1.3 server may choose unexpected key agreement group

• OpenSSL
• CWE-757

ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function

• OpenSSL
• CWE-754

Missing ASN1_TYPE validation in PKCS#12 parsing

• OpenSSL
• CWE-754

NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function

• OpenSSL
• Memory corruption

Missing ASN1_TYPE validation in TS_RESP_verify_response() function

• OpenSSL
• CWE-754

Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion

• OpenSSL
• Memory corruption

Unauthenticated/unencrypted trailing bytes with low-level OCB function calls

• OpenSSL
• CWE-325

Heap out-of-bounds write in BIO_f_linebuffer on short writes

• OpenSSL
• Memory corruption

TLS 1.3 CompressedCertificate excessive memory allocation

• OpenSSL
• Denial of service

'openssl dgst' one-shot codepath silently truncates inputs >16MB

• OpenSSL
• Weak cryptography or TLS