Skip to main content

OpenSSL EUVDEUVD-2026-35476

| CVE-2026-34180 HIGH
Out-of-bounds Read (CWE-125)
2026-06-09 GHSA-3c8f-qq7h-7qv6
OpenSSL Information Disclosure Buffer Overflow
High
Disputed · 7.5 Vendor
Share

Severity by source

Sources disagree (Low–High)
Vendor (CNA) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
3.7 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
5.0 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jun 09, 2026 - 20:23 vuln.today
Analysis Generated
Jun 09, 2026 - 20:23 vuln.today
CVSS changed
Jun 09, 2026 - 20:22 NVD
7.5 (HIGH)
CVE Published
Jun 09, 2026 - 11:43 nvd
UNKNOWN (no severity yet)
CVE Published
Jun 09, 2026 - 11:43 nvd
HIGH 7.5

Description PRE-NVD

Disclosed via GitHub release of openssl/openssl. NVD scoring and full description are pending.

Articles & Coverage 1

News 7 New OpenSSL Vulnerabilities - 1 Critical, 6 High Severity Jun 10, 2026

AnalysisAI

Denial-of-service in OpenSSL's ASN.1 content parser allows remote unauthenticated attackers to trigger a heap buffer over-read that can crash applications relying on the library for cryptographic parsing. Disclosed via the OpenSSL 4.0.1 security release on 2026-06-09 alongside more than a dozen other fixes, this issue affects every supported branch from 1.0.2 through 3.6 and 4.0. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the broad install base of OpenSSL across servers, clients, and embedded devices makes patching a priority.

Technical ContextAI

OpenSSL is the dominant open-source TLS/SSL and general-purpose cryptography library; this issue lives in its ASN.1 (Abstract Syntax Notation One) content parsing code, which is invoked when decoding the DER/BER-encoded structures that underpin X.509 certificates, CMS/PKCS#7 messages, PKCS#12 bundles, OCSP responses, and CRMF blobs. The root cause is CWE-125 (Out-of-bounds Read): malformed length or content fields cause the parser to read past the bounds of an allocated heap buffer. Because ASN.1 parsing is reached from virtually any code path that ingests certificates or signed/encrypted messages, the vulnerable code is exposed by both server and client OpenSSL consumers as well as libraries that wrap libcrypto (e.g., language bindings, package managers, mail servers, VPN daemons).

RemediationAI

Vendor-released patch: upgrade to OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6, 3.0.21, 1.1.1zh, or 1.0.2zq as appropriate for the branch in use, per the OpenSSL release at https://github.com/openssl/openssl/releases/tag/openssl-4.0.1 and the security advisory at https://openssl-library.org/news/secadv/20260609.txt; on Ubuntu apply USN-8414-2 (https://ubuntu.com/security/notices/USN-8414-2) and on other distributions track the equivalent distro security update, then restart all services that link libcrypto so the new library is loaded. If patching must be deferred, compensating controls include disabling client-certificate authentication on TLS listeners that do not require it (eliminates one attacker-controlled ASN.1 path at the cost of mTLS), rejecting S/MIME and CMS attachments at the mail gateway (breaks signed/encrypted mail workflows), and fronting OCSP responders or certificate-handling endpoints with a WAF or proxy that performs sanity checks on ASN.1 lengths (incomplete coverage and possible false positives on legitimate certificates).

More in OpenSSL

View all
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2014-0195 MEDIUM POC
6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2016-0800 MEDIUM POC
5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
CVE-2015-0204 MEDIUM POC
4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2014-3566 LOW POC
3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM POC
6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH
7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
CVE-2014-3470 MEDIUM
4.3 Jun 05

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
CVE-2017-3730 HIGH POC
7.5 May 04

In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this

CVE-2016-8610 HIGH
7.5 Nov 13

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2023-4966 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.189 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.170 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.185 Container suse/sl-micro/6.0/toolbox:13.2-9.122 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.155 Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.121 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.141 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.135 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.141 Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Affected
Container suse/sle-micro/5.5/toolbox:latest Affected

Share

EUVD-2026-35476 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy