OpenSSL
Monthly
Local privilege escalation in Acunetix 25.11.251107123 for Windows enables low-privileged local users to execute arbitrary code as SYSTEM by exploiting CWE-427 (Uncontrolled Search Path Element) in the wvsc.exe Web Vulnerability Scanning Engine. The SYSTEM-level wvsc.exe process searches for OpenSSL-related files at a hardcoded directory path that does not exist by default; an attacker creates the missing directory and plants a malicious file, which the service subsequently loads and executes, yielding full SYSTEM-level control. A public proof-of-concept is available via the Full Disclosure mailing list and corroborated by a VulnCheck advisory, making this trivially reproducible by any local user on affected Windows installations.
Double-free memory corruption in the MongoDB C Driver's OpenSSL-based TLS certificate revocation checking path allows a trusted TLS endpoint to crash the connecting client application. During the TLS handshake, a server already trusted by the client can present specially crafted certificate data that triggers a heap object being freed twice (CWE-415), causing the client process to terminate unexpectedly. The impact is a client-side denial of service; no code execution has been claimed, and the CVSS 4.0 vector (VA:H, VC:N, VI:N) corroborates an availability-only outcome with no public exploit identified at time of analysis.
Use-after-free in curl/libcurl's HTTP/2 server push handler allows a malicious or attacker-controlled server to corrupt client-side heap memory during push processing, potentially enabling denial of service or arbitrary code execution. All curl/libcurl versions prior to 8.22.0 that negotiate HTTP/2 with server push are affected. No public exploit code or CISA KEV listing has been identified at time of analysis.
Connection reuse logic in curl's native CA store code path fails to properly isolate connections that were established under differing CA verification contexts, potentially allowing a subsequent request to reuse a connection whose native-CA validation would not have succeeded independently. All curl and libcurl users on platforms using the OS-native certificate store (Windows CertStore, macOS Keychain, etc.) rather than curl's bundled CA bundle are affected in versions up to and including 8.21.0. An attacker in a position to influence connection reuse - such as a MITM or a server that shares a connection pool - could bypass native CA certificate validation for a subsequent request. No public exploit has been identified at time of analysis, and no KEV listing is present.
OpenSSL certificate pinning bypass in curl before 8.22.0 allows a network-positioned attacker to substitute a fraudulent but CA-trusted certificate for the expected pinned credential, undermining the stronger assurance that public-key pinning is specifically designed to provide over standard chain-of-trust validation. The flaw is specific to curl's OpenSSL code path and only materially affects deployments that have explicitly enabled certificate or public-key pinning (e.g., via --pinnedpubkey) as a hardening measure. curl 8.22.0, released September 2, 2026, resolves this issue; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Path traversal in wcurl for Windows allows a crafted URL containing percent-encoded backslashes to redirect a downloaded file to an attacker-controlled directory outside the user's intended destination. Affecting wcurl shipped with curl 8.14.0 through 8.21.0 and standalone wcurl 2024.12.08 through 2026.01.05, the flaw exploits Windows path-separator semantics: wcurl decodes %5C to a backslash, which Windows treats as a directory separator, causing file placement at an unintended filesystem path. No public exploit code and no active exploitation have been identified at time of analysis; vendor-released patches are available as of September 2, 2026.
curl and libcurl through version 8.21.0 incorrectly handle domain-scoped cookies for Public Suffix List (PSL) domains, permitting a malicious server to set cookies scoped to a PSL entry rather than rejecting them as standards require. This flaw enables cross-subdomain cookie propagation under shared public suffix registries (e.g., github.io, co.uk), potentially exposing session tokens or enabling session fixation against other services the victim connects to under the same PSL domain. No public exploit code exists and CISA KEV listing is absent; the vulnerability was fixed in curl 8.22.0 released September 2, 2026.
Secure cookie attribute bypass in curl allows the `Secure` flag on HTTP cookies to be circumvented when a tab character is present in a `Set-Cookie` header, causing curl to potentially transmit cookies over unencrypted HTTP connections that should be restricted to HTTPS only. The flaw affects the cookie parsing logic in curl/libcurl and is fixed in curl 8.22.0, released September 2, 2026. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog.
Negotiate (SPNEGO/Kerberos) ambient credential leakage in curl allows an attacker-controlled server to receive authentication tokens intended for a different, legitimate server via improper connection reuse. Affected are curl and libcurl through version 8.21.0 when Negotiate authentication is active and connection reuse occurs across different servers. No public exploit code has been identified and this does not appear in CISA KEV; the issue was patched in the coordinated curl 8.22.0 security release on September 2, 2026.
TLS certificate verification bypass in curl's wolfSSL backend allows custom verification callbacks to be silently skipped when a CA certificate is found in wolfSSL's cache, enabling connections that application-level policy logic would otherwise have rejected. Affected are curl releases using the wolfSSL TLS backend, fixed in curl 8.22.0 released September 2, 2026. No public exploit code or active exploitation has been identified at time of analysis.
OpenLDAP SASL authentication bypass in curl allows network-accessible exploitation when curl is used to connect to LDAP servers using SASL authentication, potentially granting unauthorized access to directory data without valid credentials. The flaw is patched in curl 8.22.0, released September 2, 2026, as part of a coordinated batch security release addressing ten separate curl vulnerabilities. No public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in curl's OpenSSL provider component, fixed in curl 8.22.0 released September 2, 2026. The flaw occurs within curl's integration layer for the OpenSSL TLS backend, where a freed memory region can be accessed during SSL/TLS connection handling. Affected deployments include any application or system using libcurl built against OpenSSL as the TLS provider; no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in Easybyte Software's Konga before 2.1.0 allows any authenticated local Windows user to execute arbitrary code at the privilege level of the account running Konga by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path that is absent from default installations and resides in a location writable by all authenticated users. The root cause is CWE-427 (Uncontrolled Search Path Element): Konga loads OpenSSL from a fixed, predictable path without verifying the integrity or provenance of files found there, enabling a classic library-planting attack. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available in version 2.1.0.
Cryptographic integrity bypass and weak key derivation in the openssl-encrypt Python package (jahlives) before 1.4.9 let an attacker with physical write access to a portable USB drive plant an undetected root-level autorun payload and precompute the drive encryption key offline. The integrity verifier only checks manifest-listed files, so added files pass verification, while a hard-coded fallback KDF salt (_LEGACY_FIXED_SALT) enables an offline rainbow-table attack against drives lacking a per-drive salt. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Path traversal in the openssl-encrypt pip package (versions before 1.4.9) enables a sandboxed plugin to escape its intended isolation and access or modify a sibling plugin's files when the two plugin directories share a name prefix. The flaw in PluginSandbox._is_safe_path performs a bare string-prefix match rather than an exact directory boundary comparison, so a plugin allowed under .../plugins/foo incorrectly passes the safety check for .../plugins/foobar. Vendor-released patch version 1.4.9 corrects the flaw; no public exploit code has been identified and the package is absent from the CISA KEV catalog.
Credential exposure in the openssl-encrypt pip package (versions ≤ 1.4.8) leaks keyserver bearer tokens in cleartext to stderr when the --debug flag is active. The root cause is a gap in sanitize_argv_for_debug(), which fails to redact the token supplied as a positional argument to the 'keyserver set-token' subcommand, leaving it visible in terminal output, CI/CD build logs, and shell history. Fixed in version 1.4.9; no public exploit identified at time of analysis, but credential exposure is immediately actionable for any attacker with access to affected log sources.
Signature-trust bypass in the openssl_encrypt Python library (PyPI 'openssl-encrypt') versions 1.4.8 and earlier lets an attacker get a forged GPG key enrolled as a plugin-signing trust anchor. Because enroll_trust_key matches key fingerprints with a suffix-tolerant comparison, an operator who verifies only a short (~32-bit, forgeable) GPG key id can be tricked into trusting an attacker-controlled colliding key, which then validly signs malicious plugins even under the strict ENFORCE signature policy. No CISA KEV listing and no public exploit identified at time of analysis; the fix is in 1.4.9.
Cleartext password leakage in openssl-encrypt before 1.4.9 exposes file encryption credentials in debug output when passwords are supplied via bundled short-option or abbreviated long-option argument forms. The tool's sanitizer, which is designed to redact sensitive arguments before writing the argv dump to stderr, fails to recognize spellings like -apHunter2 (bundled short option) or --passw (abbreviated long option), causing the raw password to appear in terminal scrollback, CI job logs, and persistent GUI debug logs. No public exploit identified at time of analysis; the vulnerability is trivially exploitable by any party with read access to the affected log output.
Key derivation function downgrade in openssl-encrypt pip package (versions ≤ 1.4.8) allows an attacker who pre-positions a crafted crypt_settings.json in the victim's process launch directory to silently collapse encryption to a single SHA-256 round, rendering resulting ciphertext trivially brute-forceable offline. A regression at line 84 of crypt_settings.py reassigns CONFIG_FILE from the intended absolute home-directory path to a bare relative filename, causing the legacy Tk GUI's SettingsTab to consume attacker-controlled KDF parameters instead of the user's legitimate settings. No public exploit is identified at time of analysis; vendor-released patch is available as version 1.4.9.
Verdict spoofing in the openssl-encrypt pip package (versions <= 1.4.8) lets an attacker who controls the contents of a scanned drive forge a PASSED tamper-check result. Because filenames read from untrusted drive data are printed by the verify-usb command without neutralizing terminal control bytes, crafted names containing cursor-movement and erase-line sequences can repaint the screen to hide genuine tamper detection. There is no public exploit identified at time of analysis and it is not in CISA KEV; the issue is fixed in 1.4.9, which routes drive-derived names through sanitize_for_display().
Uncontrolled memory allocation in the openssl-encrypt Python package (pip, versions ≤1.4.8) exposes any service invoking its `decrypt --stego-extract` command to unauthenticated denial of service via a crafted FLAC file. The STREAMINFO total_samples field - a 36-bit value fully controlled by the file author - is passed without bounds validation directly to NumPy as an array dimension, causing allocations of tens of gigabytes from a ~50-byte input. A vendor-released patch exists in version 1.4.9; no public exploit code has been identified at time of analysis, though the attack requires no authentication and minimal complexity.
Symlink-following in the openssl-encrypt pip package (jahlives/openssl_encrypt) before 1.4.9 allows an evil-maid attacker with physical access to a target USB drive to bypass the verify-usb v2 integrity check and achieve code execution on the victim's machine. The attacker replaces a tool-tree directory with a symlink to a crafted copy that includes byte-identical visible source files and a planted __pycache__/*.pyc compiled bytecode file; CPython's rglob() does not enumerate symlinked directory contents, so the planted file is never counted, verify-usb reports PASSED, and the malicious bytecode executes when the victim launches the portable install. No public exploit has been identified at time of analysis, and the attack is gated behind physical drive access and victim interaction.
Local information disclosure in the openssl-encrypt pip package (versions ≤ 1.4.8) exposes steganography passwords to all unprivileged users on the same Linux host. When the desktop GUI initiates an encrypt or decrypt operation involving the steganography feature, it spawns a CLI child process with the password supplied as the `--stego-password` command-line argument rather than via an environment variable, making it readable from `/proc/<pid>/cmdline` for the entire subprocess lifetime by any local user. The main encryption password is handled correctly via environment variable and is unaffected. A vendor-released patch is available in version 1.4.9; no public exploit has been identified at time of analysis.
Cleartext private key exposure in openssl-encrypt (pip package by jahlives) versions 1.4.8 and earlier allows any local user to read a stored mTLS client private key from a world-readable SharedPreferences file. The desktop GUI's Settings screen writes the combined certificate and private key PEM directly into a 0644-permissioned file, making it accessible to all local users on the system without elevated privileges. No public exploit or CISA KEV listing exists at time of analysis, but the trivial exploitation path (read a world-readable file) means any local user on an affected host can silently exfiltrate the private key and use it to impersonate the legitimate mTLS client.
Sensitive-file exposure in the openssl-encrypt pip package (openssl_encrypt) at versions <= 1.4.8 stems from its 'Encrypted USB Workspace' feature writing a marker that falsely declares the workspace AES-256-GCM encrypted while the derived key is never applied and the directory remains in cleartext. Users who trust the branding and store files in the workspace leave them fully readable on the removable media, so anyone with physical possession of the USB device can recover the data. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the failure silently defeats the product's core security promise.
Remote denial of service in OpenSSL's CMP subsystem affects versions 3.0.x through 4.0.x when password-based MAC (PBM)-protected messages are processed, caused by a missing ASN.1 type check that allows a crafted message to trigger an invalid pointer dereference before any MAC computation occurs. Unauthenticated remote attackers (CVSS PR:N) can crash applications acting as CMP servers via OSSL_CMP_SRV_process_request(), or crash CMP clients communicating with a malicious or intercepted CMP server. No public exploit has been identified at time of analysis; SSVC rates current exploitation as none, though the attack is rated automatable and requires no knowledge of the PBM shared secret.
Memory exhaustion in OpenSSL's QUIC stack allows any remote peer that completes a QUIC handshake to cause unbounded connection-scoped memory growth by sending repeated PING frames while withholding acknowledgments for ack-eliciting packets. Affected versions span OpenSSL 3.4.0 through early 4.0.x; TLS-only deployments and the FIPS module are unaffected. No public exploit code exists and SSVC confirms no active exploitation at time of analysis, though the attack is rated automatable (CVSS AV:N/AC:L/PR:N/UI:N), making concurrent-connection amplification straightforward.
Unbounded memory growth in OpenSSL's Certificate Management Protocol (CMP) implementation enables unauthenticated remote attackers to exhaust server memory by repeatedly sending rejected CMP messages containing large extraCerts lists. Affected are OpenSSL 3.0.x before 3.0.22, 3.4.x before 3.4.7, 3.5.x before 3.5.8, 3.6.x before 3.6.4, and 4.0.x before 4.0.2 - but only when the CMP server shares a single long-lived OSSL_CMP_CTX across requests. Vendor patches are available; SSVC classifies exploitation as 'none' and no public exploit code has been identified at time of analysis.
Denial of service in OpenSSL's CMP (Certificate Management Protocol) client affects versions 3.4.x, 3.5.x, 3.6.x and 4.0.x, where ossl_cmp_msg_check_update() passes a peer-supplied sender distinguished name directly as a format string to ERR_raise_data(). A malicious or intercepted CMP server can return a sender DN containing format specifiers (e.g. 'CN=%s%n') to crash a validating client. Despite a 9.8 CVSS score and an 'RCE' tag, the vendor explicitly states the reliable consequence is a crash only; there is no public exploit identified at time of analysis and EPSS is low (0.41%).
Heap corruption in OpenSSL's CMS decryption path allows a remote unauthenticated attacker to crash any application invoking CMS_decrypt() on attacker-supplied ciphertext. The AES-WRAP-PAD unwrap primitive writes and cleanses up to the full input length on its integrity-failure path, while the CMS layer allocates a buffer sized only for the expected output - producing a fixed-size, fixed-value (zero) 8-byte overwrite immediately past the heap allocation. No public exploit has been identified at time of analysis, but the CVSS 7.5 rating and SSVC automatable classification indicate this can be reliably triggered at scale against any service that processes externally sourced CMS messages.
DTLS memory exhaustion in OpenSSL allows unauthenticated remote peers to consume disproportionate server memory during handshake processing. Sending small forged records that claim a future epoch triggers OpenSSL to buffer the entire ~16 KB read buffer rather than just the actual record bytes, yielding an amplification factor of approximately 1,200× per record; up to 100 such records may be queued per connection, exposing roughly 1.7 MB of server memory per association from a negligible volume of transmitted data. No public exploit has been identified at time of analysis and SSVC rates exploitation status as none, but the attack is rated automatable and can be multiplied across many concurrent DTLS connections.
Remote unauthenticated denial of service in OpenSSL's QUIC server stack (versions 3.5.x before 3.5.8, 3.6.x before 3.6.4, and 4.0.x before 4.0.2) allows an attacker to crash the QUIC server process by sending a single malformed INITIAL packet with a destination connection ID shorter than 8 bytes. The crafted packet triggers a double-free of the QUIC record layer RX (QRX) object, causing heap corruption and process termination. No public exploit has been identified; remote code execution is explicitly assessed as highly improbable by the vendor, and no public exploit or active exploitation has been confirmed.
NULL pointer dereference in OpenSSL's RFC7250 Raw Public Key (RPK) TLS extension handling crashes any server or client configured in key-only RPK mode when a remote peer sends the typically omitted `signature_algorithms_cert` extension. Affected versions span OpenSSL 3.4.x through 4.0.x; impact is strictly limited to a process-aborting Denial of Service - no data disclosure or code execution is possible. No public exploit exists and CISA SSVC rates active exploitation as none, but the attack is automatable against any reachable endpoint in this non-default configuration.
Unauthenticated authentication bypass in miniOrange's SAML Single Sign-On extensions for Joomla (SAML SSO < 11.0.2, SAML SP Login with ADFS < 6.4, and SAML SSO login with Google Apps < 6.4) lets remote attackers log in as any Joomla account, including administrators. The mo_saml_validate_signature() function treats OpenSSL's -1 error return as a successful signature verification, so a crafted SAMLResponse with an attacker-chosen NameID and a deliberately malformed signature bypasses validation entirely. Rated CVSS 4.0 10.0; no public exploit identified at time of analysis, but the flaw is trivially reachable and yields full site takeover.
Cleartext transmission of TYPO3 system information occurs in the Syssy - TYPO3 Monitoring & Security Checks extension when OpenSSL is absent on the hosting server, exposing potentially sensitive configuration and system data to network interception (CWE-319). All tracked versions of the extension are affected per CPE data, though exploitation is constrained by the dual requirement of OpenSSL being unavailable and the attacker already possessing the SYSSY project's API key. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 5.3 reflects the medium-severity, partially-authenticated nature of the flaw.
TLS hostname verification is silently bypassed in Netty's OpenSSL client path, allowing a network man-in-the-middle attacker to intercept encrypted communications by presenting a certificate issued for a different hostname. Affected are applications using io.netty:netty-handler versions 4.2.0.Final through 4.2.16.Final or any 4.1.x through 4.1.136.Final, specifically when the SslProvider.OPENSSL client path is configured with a plain X509TrustManager and running on Java 25 or later, where Unsafe-based trust-manager wrapping is unavailable. No public exploit code has been identified at time of analysis, but the confidentiality impact is high for any affected deployment that transmits sensitive data over TLS.
Stack exhaustion in the Picotls minicrypto backend's custom ASN.1 validator allows an attacker who can supply crafted private-key material to crash any application that calls ptls_minicrypto_load_private_key() or the public ptls_asn1_validation() API on untrusted DER input. All Picotls versions prior to upstream commit c14231d80 are affected when the minicrypto backend is in use; applications using the libcrypto (OpenSSL) backend are immune because OpenSSL performs its own bounded DER parsing. No public exploit has been identified and no CISA KEV listing exists; CVSS 5.5 reflects a local, user-interaction-dependent denial-of-service with no code execution potential.
Global SSL/TLS certificate verification is silently disabled across all puma web process outbound connections in Mastodon when LDAP authentication is configured with LDAP_TLS_NO_VERIFY=true, enabling man-in-the-middle interception of federation traffic, API callbacks, and media fetches. Affecting versions prior to 4.4.19 and 4.5.0 through 4.5.11, the root cause is a Ruby object mutation defect: calling .tap directly on the shared global OpenSSL::SSL::SSLContext::DEFAULT_PARAMS constant (rather than a .dup copy) permanently sets VERIFY_NONE for the entire puma process lifetime, not just the LDAP connection. No public exploit identified at time of analysis, but the exact one-line fix is visible in the public commit diff, making the vulnerability trivially reproducible.
TLS certificate validation bypass in rsync enables on-path attackers to intercept and tamper with encrypted file transfer sessions. Affected are rsync 3.2.0-3.2.3 in openssl mode and rsync-ssl through 3.4.4 in stunnel mode; both fail to validate server certificates against a trusted CA and perform no hostname verification, allowing a self-signed or otherwise invalid certificate to be accepted silently. No public exploit has been identified at time of analysis, and a vendor-released patch (v3.5.0, designated a major security release) is available.
QUIC server listener in OpenSSL 3.5.x through 4.0.x allows remote unauthenticated denial of service through unbounded memory growth when processing QUIC Initial packets. Remote peers can flood the listener with Initial packets carrying novel Destination Connection IDs faster than the application drains the queue via SSL_accept(), causing per-channel state objects to accumulate without limit and exhausting process memory. No public exploit code or CISA KEV listing has been identified; vendor-confirmed patches are available in OpenSSL 3.5.8, 3.6.4, and 4.0.2.
Cleartext storage in PostgreSQL's pgcrypto extension silently exposes PGP-encrypted data as recoverable plaintext when OpenSSL disables the requested cipher, affecting all eight PGP encryption and decryption functions (pgp_sym_encrypt/decrypt, pgp_pub_encrypt/decrypt, and their bytea variants) across PostgreSQL 14 through 18. Beyond confidentiality loss, the same code path defeats the Modification Detection Code (MDC) integrity check, allowing decryption to succeed with an incorrect key - enabling an attacker to inject attacker-controlled plaintext through applications that accept encrypted data as input. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified; fix versions are clearly defined as 18.5, 17.11, 16.15, 15.19, and 14.24.
Memory exhaustion in Coturn's DTLS listener allows unauthenticated remote attackers to crash or degrade the TURN/STUN service by flooding it with fragmented DTLS ClientHello messages before cookie validation occurs. All Coturn deployments prior to version 4.16.0 are affected, as both dtls_server_input_handler() and create_new_connected_udp_socket() in dtls_listener.c retain OpenSSL reassembly state for attacker-declared inflated handshake lengths without first completing RFC 6347 cookie exchange. No public exploit has been identified at time of analysis, but the attack requires only UDP connectivity to the listener and no credentials whatsoever, making it accessible to any internet-facing adversary.
NULL pointer dereference in Crypt::OpenSSL::PKCS12 before version 1.98 for Perl enables process crashes when any caller invokes info_as_hash() on a crafted PKCS#12 file containing a zero-length BMPSTRING bag attribute. The root cause is a zero-size Renew() call that Perl's memory allocator implements as a free() returning NULL, which is subsequently dereferenced inside strlen() within a call to newSVpvn(). With no public exploit identified at time of analysis and an EPSS of 0.19%, active exploitation is currently unlikely, though any service that parses attacker-supplied PKCS#12 data and calls info_as_hash() is directly exposed to denial of service.
Memory exhaustion denial-of-service in OpenSSL 3.6.0-3.6.3 and 4.0.0-4.0.1 allows a malicious TLS server to leak attacker-tunable amounts of heap memory per handshake in connecting client applications that have explicitly enabled OCSP staple verification. By delivering a syntactically valid BasicOCSPResponse containing an empty SingleResponse sequence - optionally padded with bogus certificates to amplify each allocation - the server causes the internal OCSP_BASICRESP structure to be allocated but never freed, bypassing the cleanup path. No public exploit has been identified at time of analysis and no CISA KEV listing exists; risk is bounded by the non-default OCSP flag requirement.
PKCS#7 EnvelopedData decryption in the Python cryptography library (versions 44.0.0-49.x) leaks a Bleichenbacher oracle through four distinguishable error messages and timing side-channels during RSA PKCS#1 v1.5 key unwrapping, exposing the exact recovered plaintext length in one case. An attacker who can submit crafted EnvelopedData to an auto-decrypting service - such as an S/MIME gateway or mail filter that reflects outcomes at high volume - can adaptively recover the content-encryption key and decrypt intercepted messages. No public exploit has been identified at time of analysis, and exploitation requires very specific deployment conditions; the fix in version 50.0.0 applies RFC 3218 indistinguishability by substituting a random key on any failure.
DLL hijacking in Zucchetti FirmaCheck for Windows before 1.3.16 allows local low-privileged attackers to achieve arbitrary code execution at the privilege level of the FirmaCheck startup process. FirmaCheck.exe loads OpenSSL configuration from the unvalidated path C:\Program Files (x86)\Common Files\SSL\ without verifying the integrity or ownership of the directory; an attacker who can write to this location may plant a crafted openssl.cnf referencing an attacker-controlled DLL, which is then loaded automatically when FirmaCheck runs at system startup. No public exploit code or active exploitation has been identified at time of analysis; exploitation is reported by VulnCheck and is bounded by the local access requirement.
TLS server-identity verification bypass in FreeRDP 3.x (all versions <= 3.28.0) lets a network attacker positioned between an RDP client and server defeat certificate hostname validation. Because tls_verify_certificate()/tls_match_hostname()/x509_utils_get_dns_names() perform custom Common Name and DNS SAN string matching instead of OpenSSL's length-aware identity APIs, NUL-truncated SAN values, CN acceptance despite non-matching SANs, and IP-literal matching without iPAddress SAN comparison all pass verification. Reported by VulnCheck with a vendor patch (3.29.0); no public exploit identified at time of analysis and it is not on CISA KEV.
TLS server-authentication bypass in FreeRDP RDP client versions 3.28.0 and earlier lets a man-in-the-middle present a wildcard certificate (*.example.com) that is wrongly accepted for multi-label subdomains such as a.b.example.com. The flaw lives in tls_match_hostname() in libfreerdp/crypto/tls.c, which treats a wildcard as matching any hostname ending in the parent domain - behavior stricter OpenSSL X509_check_host() rejects. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.
Denial of service in Erlang/OTP's TLS handshake allows remote unauthenticated attackers to crash the BEAM VM by sending a crafted X.509 certificate chain. The vulnerability affects OTP versions 26.2 through 29.0.3 and specific patch releases of 27 and 28, exploiting unbounded growth of the policy tree during path validation. No active exploitation or public exploit code is known at this time, but the attack is automatable and has a high CVSS score.
Client-side denial-of-service in libssh2 through 1.11.1 allows a malicious SSH server to crash any connecting client before authentication by triggering an integer underflow during AES-GCM cipher negotiation, causing an out-of-bounds read and a near-SIZE_MAX memcpy that immediately terminates the process.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.4) lets unauthenticated attackers log in as any user, including administrators. The flaw stems from mo_saml_validate_signature() applying a loose boolean check to the tri-state integer returned by PHP's openssl_verify(), so the error value -1 is treated as truthy and accepted as a valid signature. Reported by Wordfence with a CVSS of 9.8; no public exploit has been identified at time of analysis, though the root cause and vulnerable code lines are publicly documented in the plugin source.
Improper TLS certificate validation in Gitea versions prior to 1.27.0 lets an on-path attacker intercept the internal API channel and steal the static, high-privilege INTERNAL_TOKEN. The internal API HTTP client (modules/private/internal.go) hardcodes InsecureSkipVerify:true with no config override, so gitea serv / gitea hook subprocesses accept any certificate when LOCAL_ROOT_URL uses HTTPS to a non-loopback host. A detailed proof-of-concept is published in the vendor advisory, but there is no evidence of active exploitation; the token grants full control over every /api/internal/* endpoint, including server shutdown, SSH key authorization, and arbitrary git command execution.
Integrity-protection bypass in libssh builds compiled against the OpenSSL crypto backend, caused by incorrect AES-GCM finalization checks that fail to verify the authentication tag. An in-path (man-in-the-middle) attacker positioned on an SSH session can silently alter plaintext bytes on the wire without triggering a MAC/integrity failure, defeating a core guarantee of the SSH transport layer. There is no public exploit identified at time of analysis, EPSS risk is low (0.28%, 20th percentile), and CISA SSVC rates exploitation as 'none' though 'automatable: yes'.
Heap out-of-bounds read in the Crypt::OpenSSL::X509 Perl module (versions before 2.1.3) lets a crafted X.509 certificate leak adjacent heap memory to an application that enumerates certificate extensions. When code calls extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_oid(), a certificate extension whose textual OID exceeds the fixed 129-byte buffer causes the returned hash key to include bytes read past the allocation, exposing process memory and risking a crash. No public exploit is identified at time of analysis and it is not in CISA KEV, but the fix is confirmed in release 2.1.3 and the flaw is trivially triggerable by any attacker who can supply a certificate.
Denial of service in the Crypt::OpenSSL::X509 Perl module before 2.1.3 lets a malformed X.509 certificate crash any Perl process that parses it. Four helper functions (basicC, ia5string, auth_att, keyid_data) dereference NULL pointers returned by OpenSSL's X509V3_EXT_d2i() on unparseable extensions - and keyid_data/auth_att additionally deref an akid->keyid field that is legitimately NULL for an empty Authority Key Identifier (DER 30 00). There is no public exploit identified at time of analysis, but the fix commit and a clear crash mechanism are published; CVSS is 7.5 (availability-only).
Signature-verification bypass in YesWiki (v4.6.5 and earlier, ActivityPub-federated Bazar forms) lets an unauthenticated remote attacker forge a valid ActivityPub actor and have Create/Update/Delete activities processed as if properly signed. The flaw stems from HttpSignatureService::verifySignature() using a loose boolean check (!openssl_verify(...)) that treats openssl_verify()'s -1 internal-error return as success. A detailed proof-of-concept exists (publicly available exploit code exists) demonstrating full CRUD on Bazar entries; the issue is not in CISA KEV and no EPSS score was provided.
Heap-based buffer overflow in PHP's OpenSSL extension affects all maintained PHP branches (8.2.x, 8.3.x, 8.4.x, 8.5.x) when the AES key-wrap-with-padding (AES-WRAP-PAD) algorithm per RFC 5649 is invoked. The output buffer is allocated based only on plaintext length, omitting the mandatory RFC 5649 padding expansion, causing OpenSSL to write beyond the allocated heap region, corrupt heap metadata, and abort the process. No public exploit has been identified at time of analysis; vendor-released patches are available for all affected branches.
Authentication bypass in 9router (>= 0.2.21 through 0.4.41) lets any unauthenticated remote attacker forge a valid dashboard session cookie because the JWT signing key falls back to the publicly committed hardcoded string "9router-default-secret-change-me" whenever the JWT_SECRET environment variable is unset. Since this secret is identical across every release and visible in the public repository, an attacker can pre-compute a valid auth_token, bypass the /dashboard login, and reach every API endpoint to steal stored API keys and auth tokens or take over the instance. Publicly available exploit code exists (the advisory ships a working jose-based PoC); there is no CISA KEV listing and no confirmed active exploitation at time of analysis.
Apify API token exfiltration in @apify/actors-mcp-server 0.10.7 lets a remote attacker steal a victim's bearer credential via URL authority injection (CWE-918/SSRF). Because getActorMCPServerURL() naively concatenates a trusted standby base URL with an attacker-controlled webServerMcpPath from an Actor definition, an Actor published with a value like '@attacker.example/mcp' causes the WHATWG URL parser to resolve the outbound connection to the attacker's host, and connectMCPClient() unconditionally forwards the victim's 'Authorization: Bearer <APIFY_TOKEN>' header there. Publicly available exploit code exists (a Docker-based PoC that captures the token on an attacker HTTPS server); no active exploitation is confirmed.
Arbitrary host file write in Incus before 7.1.0 lets a holder of S3 bucket credentials escape the storage volume via a path-traversal-laden multipart upload ID and plant files anywhere the daemon (typically root) can write, escalating to remote code execution. The flaw lives in the local S3 storage backend's multipart upload handling, where the attacker-supplied uploadId is concatenated onto the uploads directory without sanitization. A complete working PoC exists that drops a /etc/cron.d job for root command execution; no CISA KEV listing or EPSS score is provided, so this is publicly available exploit code rather than confirmed active exploitation.
Privilege escalation to AWS IAM and PKI compromise in Netflix Lemur 1.9.0 (and earlier) lets any SSO-authenticated, low-privilege user chain an ACME acme_url SSRF with a creator-equality IDOR to steal the worker's AWS STS credentials and retain permanent access to issued TLS private keys. Because Lemur auto-provisions new SSO identities as active=True, any holder of a trusted federated identity can reach the vulnerable authority-creation and key-fetch endpoints. A detailed, fully reproduced proof-of-concept (Docker lab plus asciinema recording) exists publicly, though there is no public exploit identified as being used in active attacks and the issue is fixed in 1.9.2.
Server-Side Request Forgery in Netflix Lemur's certificate verification pipeline allows an authenticated operator-role user to force the Lemur host to issue outbound HTTP requests to arbitrary internal destinations by uploading a crafted certificate whose CRL Distribution Point or OCSP responder extensions point to RFC1918 addresses, link-local endpoints (169.254.169.254), internal Kubernetes API servers, or loopback interfaces. Both `crl_verify` and `ocsp_verify` in `lemur/certificates/verify.py` pass attacker-controlled URLs directly to network sinks with no destination allow-list, scheme restriction beyond LDAP rejection, or private-address filtering. No public exploit confirmed in CISA KEV, but detailed proof-of-concept reproduction steps are published in the GitHub Security Advisory GHSA-54vg-pfh7-jq95; vendor-released patch v1.9.2 is available.
HMAC tag forgery in wolfSSL's OpenSSL-compatibility layer allows a zero-length or arbitrarily truncated HMAC tag to pass verification in EVP_DigestVerifyFinal, undermining message authentication for any application relying on this API path. Applications compiled with the OPENSSL_EXTRA flag that use EVP_DigestVerifyFinal for HMAC verification - including JWT validation libraries and message authentication flows - are affected across all currently-known wolfSSL versions. The root length check only enforced that the supplied tag did not exceed the MAC size, not that it equaled it, so an attacker controlling the tag buffer or length argument could present an empty signature and bypass integrity verification. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
X.509 trust-chain bypass in wolfSSL's OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert/X509_verify_cert) allows an attacker to have an attacker-controlled certificate accepted as valid by presenting a chain that never reaches a configured trust anchor. The flaw affects only builds compiled with --enable-opensslextra whose applications perform certificate validation via the OpenSSL-compat X509_verify_cert() API using caller-supplied untrusted intermediates; for those deployments it is critical (CVSS 4.0 base 8.7, integrity impact only). There is no public exploit identified at time of analysis and it is not on CISA KEV, but an upstream fix is available via wolfSSL PR #10674.
Certificate chain validation bypass in wolfSSL's OpenSSL-compatibility layer permits a crafted intermediate CA certificate asserting CA:TRUE but missing the keyCertSign key usage bit to be accepted as a valid signing CA during path building. Affected deployments are those compiled with OPENSSL_EXTRA or OPENSSL_ALL that use the X509_verify_cert/X509_STORE API; native wolfSSL verification is entirely unaffected. No public exploit identified at time of analysis, and no CISA KEV listing exists, but the integrity risk is concrete for any application relying on wolfSSL's OpenSSL-compat path for mutual TLS or client certificate authentication.
Certificate trust-chain bypass in wolfSSL allows attackers to have an attacker-controlled certificate accepted as valid, but only in builds compiled with --enable-opensslextra where the application calls the OpenSSL-compatibility X509_verify_cert() with caller-supplied untrusted intermediates. The verifier returned success based on the last verified link instead of confirming the chain reaches a configured trust anchor, so a chain deeper than the maximum path depth (default 100) is accepted without ever validating against a trusted root. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; native wolfSSL TLS/DTLS and the default WOLFSSL_VERIFY_PEER handshake are unaffected.
Signature-verification bypass in wolfSSL's OpenSSL compatibility layer allows a degenerate (certs-only) PKCS#7 object - one with empty signerInfos and no actual signature - to be falsely reported as verified by wolfSSL_PKCS7_verify(). Applications using the PKCS7_verify() compat API to authenticate attacker-supplied PKCS#7/CMS bundles can be tricked into treating unsigned content as authentic, undermining integrity guarantees. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the underlying defect is a classic improper-signature-verification (CWE-347) issue with a CVSS 4.0 base score of 8.2.
Certificate chain validation bypass in wolfSSL's OpenSSL compatibility layer allows a network attacker to present a chain terminating at an untrusted intermediate they control, which is accepted as valid when X509_V_FLAG_PARTIAL_CHAIN is enabled. The flaw (CWE-295) resided in wolfSSL_X509_verify_cert, where the partial-chain fallback confirmed only that some intermediate was temporarily loaded into the CertManager during path building - not that the terminal certificate was in the caller's actual trust store. No public exploit code exists and no CISA KEV listing is present, but successful exploitation defeats certificate validation entirely, enabling impersonation or MITM in affected configurations.
Heap out-of-bounds read in the Perl module Crypt::OpenSSL::PKCS12 before version 1.96 lets a crafted PKCS#12 file leak adjacent process heap memory into Perl scalars when its attributes are printed. Because print_attribute() copies a UTF8STRING value with strncpy into a buffer sized to the exact declared length and never NUL-terminates it, downstream strlen()/newSVpvn() reads past the buffer end. No public exploit identified at time of analysis, EPSS is low (0.35%), and it is not on CISA KEV, but the SSVC framework flags it as automatable with partial technical impact.
Unauthenticated call-control abuse in pipecat-ai development runner (>=0.0.77, <1.4.0) allows remote attackers reaching an exposed `/ws` telephony WebSocket to inject an attacker-controlled `callSid` that the server then submits to Twilio, Telnyx, or Plivo REST APIs using the operator's own credentials, forcibly terminating victim calls. Publicly available exploit code exists (a full Dockerized PoC is published in the GHSA advisory) and the maintainers shipped a fix in v1.4.0; no CISA KEV listing at time of analysis.
Server-side request forgery in Gotenberg v8.33.0 and earlier allows remote unauthenticated attackers to coerce the server into making arbitrary outbound HTTP(S) requests and to disclose local image files by uploading a crafted DOCX to the /forms/libreoffice/convert endpoint. The flaw stems from LibreOffice automatically resolving external and local resources referenced in <img> tags during conversion, exposing internal networks and on-disk image files. Publicly available exploit code exists via the vendor's GHSA-2mrg-35hw-x3x9 advisory, though no CISA KEV listing or EPSS data is available at time of analysis.
mTLS bypass in Traefik v3.6.17 through v3.7.2 allows unauthenticated remote clients to reach backends protected by router-specific client-certificate policies by negotiating over HTTP/3 (QUIC). The QUIC TLS configuration selector performs only an exact, case-sensitive SNI map lookup, so wildcard host rules (e.g. `*.example.com`) and mixed-case SNI values fall back to the default TLS configuration, which typically does not require a client certificate, while the HTTP routing layer still dispatches the request to the protected backend. Publicly available exploit code exists in the GitHub Security Advisory GHSA-9cr8-q42q-g8m7, but there is no public exploit identified at time of analysis indicating active in-the-wild abuse.
Cryptographic primality validation in Deno's Node.js compatibility layer (versions <= 2.8.0) silently skips Miller-Rabin testing when `crypto.checkPrime`/`checkPrimeSync` is called with default options, causing crafted composites whose smallest prime factor exceeds 17,863 (e.g. 17,881 × 17,891) to be reported as prime. Remote attackers who control bignums fed into a victim Deno application can therefore smuggle composite values past validation, with no public exploit identified at time of analysis beyond the vendor-published reproducer.
Mutual-TLS bypass in Traefik v3.7.0 and v3.7.1 lets unauthenticated remote attackers reach backends protected by wildcard-router `TLSOptions` (for example `Host("*.example.com")` with `RequireAndVerifyClientCert`). The `SNICheck` domain-fronting middleware resolves TLS options for the HTTP `Host` header via exact map lookups only, so an attacker completing the TLS handshake under a permissive SNI on the same entrypoint can then send a `Host` header for the wildcard-protected backend and skip the client-certificate requirement. Publicly available exploit code exists in the GitHub Security Advisory PoC; this is independent of the prior HTTP/3 mTLS issue.
Authentication bypass in dhax/go-base Go REST API boilerplate (versions prior to commit cc82b974, merged May 17, 2026) allows remote unauthenticated attackers to forge JWT tokens for arbitrary users including administrators. The signing secret is hardcoded to the literal string 'random' in both the dev.env template and as a Viper default in cmd/serve.go, and publicly available exploit code exists in the advisory. No CISA KEV listing or EPSS data is provided, but the secret is trivially derivable from the public GitHub repository.
Cryptographic message forgery in OpenSSL (branches 3.0.x, 3.4.x, 3.5.x, 3.6.x, and 4.0.0) allows an attacker to craft CMS AuthEnvelopedData messages that pass authentication and are accepted as genuine, defeating the integrity guarantee of CMS authenticated encryption. Any application relying on OpenSSL's CMS layer to reject tampered or forged authenticated-envelope messages can be tricked into processing attacker-controlled content as trusted. There is no public exploit identified at time of analysis, EPSS is 0.00%, and CISA SSVC lists exploitation status as none, but the flaw is network-reachable with no privileges required.
Incorrect authentication tag processing for empty messages in OpenSSL's AES-GCM-SIV and AES-SIV cipher modes enables network-positioned attackers to bypass integrity guarantees on empty ciphertext, yielding limited confidentiality and integrity violations (CVSS 4.8, CWE-325). Affected branches span OpenSSL 3.0.x through 4.0.0, all patched in the OpenSSL 4.0.1 security release dated 2026-06-09. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Null pointer dereference in OpenSSL's password-based CMS decryption path enables remote denial of service against applications that process CMS EnvelopedData with password-based key derivation. The flaw affects a wide range of OpenSSL branches spanning 1.0.2 through 4.0.0, making the exposure surface unusually broad across long-term support and current releases. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS score of 5.9 (Medium) reflects the high attack complexity required to trigger the condition.
Integrity-check bypass in OpenSSL 3.4.x, 3.5.x, 3.6.x, and 4.0.0 allows PKCS#12 files protected with PBMAC1 to be accepted even when secured by dangerously short HMAC keys, undermining the authentication of the keystore contents. Vendor patches are available in 3.4.6, 3.5.7, 3.6.3, and 4.0.1, and no public exploit identified at time of analysis; EPSS is 0.00% and the issue is not on the CISA KEV list.
Denial of service in OpenSSL QUIC implementation allows remote unauthenticated attackers to exhaust server memory by sending crafted PATH_CHALLENGE frames that trigger unbounded memory growth in the QUIC handler. The flaw affects OpenSSL branches 3.4.x, 3.5.x, 3.6.x, and 4.0.0, and is fixed in the 4.0.1 security release alongside numerous other CVEs. No public exploit identified at time of analysis and EPSS is very low (0.02%), but the network-reachable, no-auth nature of QUIC server endpoints makes the issue operationally relevant for TLS/QUIC-facing services.
Heap buffer overflow in OpenSSL's ASN.1 multibyte string conversion routine allows remote attackers to corrupt memory and potentially achieve code execution against applications using affected OpenSSL versions prior to 4.0.1. The flaw was disclosed via the OpenSSL 4.0.1 security patch release alongside 17 other CVEs and is classified as a high-severity issue (CVSS 8.1) with no public exploit identified at time of analysis.
Denial of service in OpenSSL 3.6.0-3.6.2 and 4.0.0 allows remote attackers to crash applications by triggering a NULL pointer dereference during certificate verification when OCSP checking is enabled. The flaw is patched in OpenSSL 4.0.1 (and 3.6.3) per the vendor's 2026-06-09 security advisory; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial-of-service in OpenSSL's ASN.1 content parser allows remote unauthenticated attackers to trigger a heap buffer over-read that can crash applications relying on the library for cryptographic parsing. Disclosed via the OpenSSL 4.0.1 security release on 2026-06-09 alongside more than a dozen other fixes, this issue affects every supported branch from 1.0.2 through 3.6 and 4.0. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the broad install base of OpenSSL across servers, clients, and embedded devices makes patching a priority.
Out-of-bounds read in OpenSSL 4.0.0's `X509_VERIFY_PARAM_set1_email()` function can crash applications performing email-based X.509 certificate verification when processing attacker-influenced email input, resulting in a denial-of-service condition. The vulnerability is scoped to OpenSSL 4.0.0 only and was patched in the June 9, 2026 security release (4.0.1), which bundled fixes for 18 CVEs. No public exploit identified at time of analysis and no CISA KEV listing.
Trust anchor substitution in OpenSSL's CMP rootCaKeyUpdate handler allows a network-positioned attacker with low privileges to bypass certificate validation via a cert/issuer field confusion bug (CWE-295), affecting four actively maintained OpenSSL branches. The high confidentiality impact (C:H) reflects the potential for a substituted malicious trust anchor to undermine TLS certificate chains, enabling downstream interception of protected communications. No public exploit identified at time of analysis; vendor patch released 2026-06-09 across all affected branches.
Denial of service in OpenSSL 3.5.x, 3.6.x, and 4.0.0 stems from a NULL pointer dereference triggered during QUIC server initial packet handling, allowing remote unauthenticated attackers to crash affected servers by sending crafted QUIC traffic. The flaw was disclosed via the OpenSSL 4.0.1 security release on 2026-06-09 alongside multiple other CVEs; no public exploit identified at time of analysis and no CISA KEV listing. Patched versions are available from the upstream project and downstream distributions including Ubuntu (USN-8414-1).
FFC-DH peer validation in OpenSSL incorrectly accepts an attacker-supplied `q` (subgroup order) parameter instead of using the locally trusted value, undermining the cryptographic integrity of Diffie-Hellman key exchange. Affected branches span OpenSSL 3.0.x, 3.4.x, 3.5.x, 3.6.x, and 4.0.0, with patched releases issued across all five branches on 2026-06-09. With a CVSS score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) and no confirmed active exploitation or public proof-of-concept, this is a moderate-priority patch item rather than an emergency response trigger - though its broad reach across widely deployed OpenSSL branches warrants timely remediation.
Bleichenbacher oracle in OpenSSL's CMS_decrypt() and PKCS7_decrypt() functions exposes RSA-encrypted message content to unauthenticated remote attackers who can submit adaptive chosen-ciphertext queries against multi-RecipientInfo CMS/PKCS7 structures. Four active OpenSSL branches are affected (3.4.x, 3.5.x, 3.6.x, and 4.0.x), with patches released under the coordinated OpenSSL security advisory on 2026-06-09. No public exploit code and no active exploitation have been identified at time of analysis; SSVC rates this non-automatable with partial technical impact, consistent with the attack's high operational complexity.
Confidentiality break in OpenSSL's AES-OCB implementation stems from the EVP_Cipher() code path ignoring the caller-supplied initialization vector (IV), causing the cipher to operate with a fixed/default IV instead. Affected branches include 3.0.x prior to 3.0.21, 3.4.x prior to 3.4.6, 3.5.x prior to 3.5.7, 3.6.x prior to 3.6.3, and 4.0.0, fixed in OpenSSL 4.0.1 and corresponding maintenance releases. With no public exploit identified at time of analysis and no CISA KEV listing, the issue is rated High (CVSS 7.5) due to high confidentiality impact via network-reachable cryptographic operations.
NULL pointer dereference in OpenSSL's CRMF EncryptedValue decryption path crashes the affected process, creating a remotely triggerable denial-of-service condition across five actively maintained OpenSSL branches (3.0.x, 3.4.x, 3.5.x, 3.6.x, and 4.0.x). The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, score 5.9) confirms network reachability with no authentication required, but high attack complexity limits trivial mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the broad version coverage and OpenSSL's ubiquitous deployment make patching a priority for any infrastructure using certificate management protocols.
Local privilege escalation in Acunetix 25.11.251107123 for Windows enables low-privileged local users to execute arbitrary code as SYSTEM by exploiting CWE-427 (Uncontrolled Search Path Element) in the wvsc.exe Web Vulnerability Scanning Engine. The SYSTEM-level wvsc.exe process searches for OpenSSL-related files at a hardcoded directory path that does not exist by default; an attacker creates the missing directory and plants a malicious file, which the service subsequently loads and executes, yielding full SYSTEM-level control. A public proof-of-concept is available via the Full Disclosure mailing list and corroborated by a VulnCheck advisory, making this trivially reproducible by any local user on affected Windows installations.
Double-free memory corruption in the MongoDB C Driver's OpenSSL-based TLS certificate revocation checking path allows a trusted TLS endpoint to crash the connecting client application. During the TLS handshake, a server already trusted by the client can present specially crafted certificate data that triggers a heap object being freed twice (CWE-415), causing the client process to terminate unexpectedly. The impact is a client-side denial of service; no code execution has been claimed, and the CVSS 4.0 vector (VA:H, VC:N, VI:N) corroborates an availability-only outcome with no public exploit identified at time of analysis.
Use-after-free in curl/libcurl's HTTP/2 server push handler allows a malicious or attacker-controlled server to corrupt client-side heap memory during push processing, potentially enabling denial of service or arbitrary code execution. All curl/libcurl versions prior to 8.22.0 that negotiate HTTP/2 with server push are affected. No public exploit code or CISA KEV listing has been identified at time of analysis.
Connection reuse logic in curl's native CA store code path fails to properly isolate connections that were established under differing CA verification contexts, potentially allowing a subsequent request to reuse a connection whose native-CA validation would not have succeeded independently. All curl and libcurl users on platforms using the OS-native certificate store (Windows CertStore, macOS Keychain, etc.) rather than curl's bundled CA bundle are affected in versions up to and including 8.21.0. An attacker in a position to influence connection reuse - such as a MITM or a server that shares a connection pool - could bypass native CA certificate validation for a subsequent request. No public exploit has been identified at time of analysis, and no KEV listing is present.
OpenSSL certificate pinning bypass in curl before 8.22.0 allows a network-positioned attacker to substitute a fraudulent but CA-trusted certificate for the expected pinned credential, undermining the stronger assurance that public-key pinning is specifically designed to provide over standard chain-of-trust validation. The flaw is specific to curl's OpenSSL code path and only materially affects deployments that have explicitly enabled certificate or public-key pinning (e.g., via --pinnedpubkey) as a hardening measure. curl 8.22.0, released September 2, 2026, resolves this issue; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Path traversal in wcurl for Windows allows a crafted URL containing percent-encoded backslashes to redirect a downloaded file to an attacker-controlled directory outside the user's intended destination. Affecting wcurl shipped with curl 8.14.0 through 8.21.0 and standalone wcurl 2024.12.08 through 2026.01.05, the flaw exploits Windows path-separator semantics: wcurl decodes %5C to a backslash, which Windows treats as a directory separator, causing file placement at an unintended filesystem path. No public exploit code and no active exploitation have been identified at time of analysis; vendor-released patches are available as of September 2, 2026.
curl and libcurl through version 8.21.0 incorrectly handle domain-scoped cookies for Public Suffix List (PSL) domains, permitting a malicious server to set cookies scoped to a PSL entry rather than rejecting them as standards require. This flaw enables cross-subdomain cookie propagation under shared public suffix registries (e.g., github.io, co.uk), potentially exposing session tokens or enabling session fixation against other services the victim connects to under the same PSL domain. No public exploit code exists and CISA KEV listing is absent; the vulnerability was fixed in curl 8.22.0 released September 2, 2026.
Secure cookie attribute bypass in curl allows the `Secure` flag on HTTP cookies to be circumvented when a tab character is present in a `Set-Cookie` header, causing curl to potentially transmit cookies over unencrypted HTTP connections that should be restricted to HTTPS only. The flaw affects the cookie parsing logic in curl/libcurl and is fixed in curl 8.22.0, released September 2, 2026. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog.
Negotiate (SPNEGO/Kerberos) ambient credential leakage in curl allows an attacker-controlled server to receive authentication tokens intended for a different, legitimate server via improper connection reuse. Affected are curl and libcurl through version 8.21.0 when Negotiate authentication is active and connection reuse occurs across different servers. No public exploit code has been identified and this does not appear in CISA KEV; the issue was patched in the coordinated curl 8.22.0 security release on September 2, 2026.
TLS certificate verification bypass in curl's wolfSSL backend allows custom verification callbacks to be silently skipped when a CA certificate is found in wolfSSL's cache, enabling connections that application-level policy logic would otherwise have rejected. Affected are curl releases using the wolfSSL TLS backend, fixed in curl 8.22.0 released September 2, 2026. No public exploit code or active exploitation has been identified at time of analysis.
OpenLDAP SASL authentication bypass in curl allows network-accessible exploitation when curl is used to connect to LDAP servers using SASL authentication, potentially granting unauthorized access to directory data without valid credentials. The flaw is patched in curl 8.22.0, released September 2, 2026, as part of a coordinated batch security release addressing ten separate curl vulnerabilities. No public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in curl's OpenSSL provider component, fixed in curl 8.22.0 released September 2, 2026. The flaw occurs within curl's integration layer for the OpenSSL TLS backend, where a freed memory region can be accessed during SSL/TLS connection handling. Affected deployments include any application or system using libcurl built against OpenSSL as the TLS provider; no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in Easybyte Software's Konga before 2.1.0 allows any authenticated local Windows user to execute arbitrary code at the privilege level of the account running Konga by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path that is absent from default installations and resides in a location writable by all authenticated users. The root cause is CWE-427 (Uncontrolled Search Path Element): Konga loads OpenSSL from a fixed, predictable path without verifying the integrity or provenance of files found there, enabling a classic library-planting attack. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available in version 2.1.0.
Cryptographic integrity bypass and weak key derivation in the openssl-encrypt Python package (jahlives) before 1.4.9 let an attacker with physical write access to a portable USB drive plant an undetected root-level autorun payload and precompute the drive encryption key offline. The integrity verifier only checks manifest-listed files, so added files pass verification, while a hard-coded fallback KDF salt (_LEGACY_FIXED_SALT) enables an offline rainbow-table attack against drives lacking a per-drive salt. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Path traversal in the openssl-encrypt pip package (versions before 1.4.9) enables a sandboxed plugin to escape its intended isolation and access or modify a sibling plugin's files when the two plugin directories share a name prefix. The flaw in PluginSandbox._is_safe_path performs a bare string-prefix match rather than an exact directory boundary comparison, so a plugin allowed under .../plugins/foo incorrectly passes the safety check for .../plugins/foobar. Vendor-released patch version 1.4.9 corrects the flaw; no public exploit code has been identified and the package is absent from the CISA KEV catalog.
Credential exposure in the openssl-encrypt pip package (versions ≤ 1.4.8) leaks keyserver bearer tokens in cleartext to stderr when the --debug flag is active. The root cause is a gap in sanitize_argv_for_debug(), which fails to redact the token supplied as a positional argument to the 'keyserver set-token' subcommand, leaving it visible in terminal output, CI/CD build logs, and shell history. Fixed in version 1.4.9; no public exploit identified at time of analysis, but credential exposure is immediately actionable for any attacker with access to affected log sources.
Signature-trust bypass in the openssl_encrypt Python library (PyPI 'openssl-encrypt') versions 1.4.8 and earlier lets an attacker get a forged GPG key enrolled as a plugin-signing trust anchor. Because enroll_trust_key matches key fingerprints with a suffix-tolerant comparison, an operator who verifies only a short (~32-bit, forgeable) GPG key id can be tricked into trusting an attacker-controlled colliding key, which then validly signs malicious plugins even under the strict ENFORCE signature policy. No CISA KEV listing and no public exploit identified at time of analysis; the fix is in 1.4.9.
Cleartext password leakage in openssl-encrypt before 1.4.9 exposes file encryption credentials in debug output when passwords are supplied via bundled short-option or abbreviated long-option argument forms. The tool's sanitizer, which is designed to redact sensitive arguments before writing the argv dump to stderr, fails to recognize spellings like -apHunter2 (bundled short option) or --passw (abbreviated long option), causing the raw password to appear in terminal scrollback, CI job logs, and persistent GUI debug logs. No public exploit identified at time of analysis; the vulnerability is trivially exploitable by any party with read access to the affected log output.
Key derivation function downgrade in openssl-encrypt pip package (versions ≤ 1.4.8) allows an attacker who pre-positions a crafted crypt_settings.json in the victim's process launch directory to silently collapse encryption to a single SHA-256 round, rendering resulting ciphertext trivially brute-forceable offline. A regression at line 84 of crypt_settings.py reassigns CONFIG_FILE from the intended absolute home-directory path to a bare relative filename, causing the legacy Tk GUI's SettingsTab to consume attacker-controlled KDF parameters instead of the user's legitimate settings. No public exploit is identified at time of analysis; vendor-released patch is available as version 1.4.9.
Verdict spoofing in the openssl-encrypt pip package (versions <= 1.4.8) lets an attacker who controls the contents of a scanned drive forge a PASSED tamper-check result. Because filenames read from untrusted drive data are printed by the verify-usb command without neutralizing terminal control bytes, crafted names containing cursor-movement and erase-line sequences can repaint the screen to hide genuine tamper detection. There is no public exploit identified at time of analysis and it is not in CISA KEV; the issue is fixed in 1.4.9, which routes drive-derived names through sanitize_for_display().
Uncontrolled memory allocation in the openssl-encrypt Python package (pip, versions ≤1.4.8) exposes any service invoking its `decrypt --stego-extract` command to unauthenticated denial of service via a crafted FLAC file. The STREAMINFO total_samples field - a 36-bit value fully controlled by the file author - is passed without bounds validation directly to NumPy as an array dimension, causing allocations of tens of gigabytes from a ~50-byte input. A vendor-released patch exists in version 1.4.9; no public exploit code has been identified at time of analysis, though the attack requires no authentication and minimal complexity.
Symlink-following in the openssl-encrypt pip package (jahlives/openssl_encrypt) before 1.4.9 allows an evil-maid attacker with physical access to a target USB drive to bypass the verify-usb v2 integrity check and achieve code execution on the victim's machine. The attacker replaces a tool-tree directory with a symlink to a crafted copy that includes byte-identical visible source files and a planted __pycache__/*.pyc compiled bytecode file; CPython's rglob() does not enumerate symlinked directory contents, so the planted file is never counted, verify-usb reports PASSED, and the malicious bytecode executes when the victim launches the portable install. No public exploit has been identified at time of analysis, and the attack is gated behind physical drive access and victim interaction.
Local information disclosure in the openssl-encrypt pip package (versions ≤ 1.4.8) exposes steganography passwords to all unprivileged users on the same Linux host. When the desktop GUI initiates an encrypt or decrypt operation involving the steganography feature, it spawns a CLI child process with the password supplied as the `--stego-password` command-line argument rather than via an environment variable, making it readable from `/proc/<pid>/cmdline` for the entire subprocess lifetime by any local user. The main encryption password is handled correctly via environment variable and is unaffected. A vendor-released patch is available in version 1.4.9; no public exploit has been identified at time of analysis.
Cleartext private key exposure in openssl-encrypt (pip package by jahlives) versions 1.4.8 and earlier allows any local user to read a stored mTLS client private key from a world-readable SharedPreferences file. The desktop GUI's Settings screen writes the combined certificate and private key PEM directly into a 0644-permissioned file, making it accessible to all local users on the system without elevated privileges. No public exploit or CISA KEV listing exists at time of analysis, but the trivial exploitation path (read a world-readable file) means any local user on an affected host can silently exfiltrate the private key and use it to impersonate the legitimate mTLS client.
Sensitive-file exposure in the openssl-encrypt pip package (openssl_encrypt) at versions <= 1.4.8 stems from its 'Encrypted USB Workspace' feature writing a marker that falsely declares the workspace AES-256-GCM encrypted while the derived key is never applied and the directory remains in cleartext. Users who trust the branding and store files in the workspace leave them fully readable on the removable media, so anyone with physical possession of the USB device can recover the data. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the failure silently defeats the product's core security promise.
Remote denial of service in OpenSSL's CMP subsystem affects versions 3.0.x through 4.0.x when password-based MAC (PBM)-protected messages are processed, caused by a missing ASN.1 type check that allows a crafted message to trigger an invalid pointer dereference before any MAC computation occurs. Unauthenticated remote attackers (CVSS PR:N) can crash applications acting as CMP servers via OSSL_CMP_SRV_process_request(), or crash CMP clients communicating with a malicious or intercepted CMP server. No public exploit has been identified at time of analysis; SSVC rates current exploitation as none, though the attack is rated automatable and requires no knowledge of the PBM shared secret.
Memory exhaustion in OpenSSL's QUIC stack allows any remote peer that completes a QUIC handshake to cause unbounded connection-scoped memory growth by sending repeated PING frames while withholding acknowledgments for ack-eliciting packets. Affected versions span OpenSSL 3.4.0 through early 4.0.x; TLS-only deployments and the FIPS module are unaffected. No public exploit code exists and SSVC confirms no active exploitation at time of analysis, though the attack is rated automatable (CVSS AV:N/AC:L/PR:N/UI:N), making concurrent-connection amplification straightforward.
Unbounded memory growth in OpenSSL's Certificate Management Protocol (CMP) implementation enables unauthenticated remote attackers to exhaust server memory by repeatedly sending rejected CMP messages containing large extraCerts lists. Affected are OpenSSL 3.0.x before 3.0.22, 3.4.x before 3.4.7, 3.5.x before 3.5.8, 3.6.x before 3.6.4, and 4.0.x before 4.0.2 - but only when the CMP server shares a single long-lived OSSL_CMP_CTX across requests. Vendor patches are available; SSVC classifies exploitation as 'none' and no public exploit code has been identified at time of analysis.
Denial of service in OpenSSL's CMP (Certificate Management Protocol) client affects versions 3.4.x, 3.5.x, 3.6.x and 4.0.x, where ossl_cmp_msg_check_update() passes a peer-supplied sender distinguished name directly as a format string to ERR_raise_data(). A malicious or intercepted CMP server can return a sender DN containing format specifiers (e.g. 'CN=%s%n') to crash a validating client. Despite a 9.8 CVSS score and an 'RCE' tag, the vendor explicitly states the reliable consequence is a crash only; there is no public exploit identified at time of analysis and EPSS is low (0.41%).
Heap corruption in OpenSSL's CMS decryption path allows a remote unauthenticated attacker to crash any application invoking CMS_decrypt() on attacker-supplied ciphertext. The AES-WRAP-PAD unwrap primitive writes and cleanses up to the full input length on its integrity-failure path, while the CMS layer allocates a buffer sized only for the expected output - producing a fixed-size, fixed-value (zero) 8-byte overwrite immediately past the heap allocation. No public exploit has been identified at time of analysis, but the CVSS 7.5 rating and SSVC automatable classification indicate this can be reliably triggered at scale against any service that processes externally sourced CMS messages.
DTLS memory exhaustion in OpenSSL allows unauthenticated remote peers to consume disproportionate server memory during handshake processing. Sending small forged records that claim a future epoch triggers OpenSSL to buffer the entire ~16 KB read buffer rather than just the actual record bytes, yielding an amplification factor of approximately 1,200× per record; up to 100 such records may be queued per connection, exposing roughly 1.7 MB of server memory per association from a negligible volume of transmitted data. No public exploit has been identified at time of analysis and SSVC rates exploitation status as none, but the attack is rated automatable and can be multiplied across many concurrent DTLS connections.
Remote unauthenticated denial of service in OpenSSL's QUIC server stack (versions 3.5.x before 3.5.8, 3.6.x before 3.6.4, and 4.0.x before 4.0.2) allows an attacker to crash the QUIC server process by sending a single malformed INITIAL packet with a destination connection ID shorter than 8 bytes. The crafted packet triggers a double-free of the QUIC record layer RX (QRX) object, causing heap corruption and process termination. No public exploit has been identified; remote code execution is explicitly assessed as highly improbable by the vendor, and no public exploit or active exploitation has been confirmed.
NULL pointer dereference in OpenSSL's RFC7250 Raw Public Key (RPK) TLS extension handling crashes any server or client configured in key-only RPK mode when a remote peer sends the typically omitted `signature_algorithms_cert` extension. Affected versions span OpenSSL 3.4.x through 4.0.x; impact is strictly limited to a process-aborting Denial of Service - no data disclosure or code execution is possible. No public exploit exists and CISA SSVC rates active exploitation as none, but the attack is automatable against any reachable endpoint in this non-default configuration.
Unauthenticated authentication bypass in miniOrange's SAML Single Sign-On extensions for Joomla (SAML SSO < 11.0.2, SAML SP Login with ADFS < 6.4, and SAML SSO login with Google Apps < 6.4) lets remote attackers log in as any Joomla account, including administrators. The mo_saml_validate_signature() function treats OpenSSL's -1 error return as a successful signature verification, so a crafted SAMLResponse with an attacker-chosen NameID and a deliberately malformed signature bypasses validation entirely. Rated CVSS 4.0 10.0; no public exploit identified at time of analysis, but the flaw is trivially reachable and yields full site takeover.
Cleartext transmission of TYPO3 system information occurs in the Syssy - TYPO3 Monitoring & Security Checks extension when OpenSSL is absent on the hosting server, exposing potentially sensitive configuration and system data to network interception (CWE-319). All tracked versions of the extension are affected per CPE data, though exploitation is constrained by the dual requirement of OpenSSL being unavailable and the attacker already possessing the SYSSY project's API key. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 5.3 reflects the medium-severity, partially-authenticated nature of the flaw.
TLS hostname verification is silently bypassed in Netty's OpenSSL client path, allowing a network man-in-the-middle attacker to intercept encrypted communications by presenting a certificate issued for a different hostname. Affected are applications using io.netty:netty-handler versions 4.2.0.Final through 4.2.16.Final or any 4.1.x through 4.1.136.Final, specifically when the SslProvider.OPENSSL client path is configured with a plain X509TrustManager and running on Java 25 or later, where Unsafe-based trust-manager wrapping is unavailable. No public exploit code has been identified at time of analysis, but the confidentiality impact is high for any affected deployment that transmits sensitive data over TLS.
Stack exhaustion in the Picotls minicrypto backend's custom ASN.1 validator allows an attacker who can supply crafted private-key material to crash any application that calls ptls_minicrypto_load_private_key() or the public ptls_asn1_validation() API on untrusted DER input. All Picotls versions prior to upstream commit c14231d80 are affected when the minicrypto backend is in use; applications using the libcrypto (OpenSSL) backend are immune because OpenSSL performs its own bounded DER parsing. No public exploit has been identified and no CISA KEV listing exists; CVSS 5.5 reflects a local, user-interaction-dependent denial-of-service with no code execution potential.
Global SSL/TLS certificate verification is silently disabled across all puma web process outbound connections in Mastodon when LDAP authentication is configured with LDAP_TLS_NO_VERIFY=true, enabling man-in-the-middle interception of federation traffic, API callbacks, and media fetches. Affecting versions prior to 4.4.19 and 4.5.0 through 4.5.11, the root cause is a Ruby object mutation defect: calling .tap directly on the shared global OpenSSL::SSL::SSLContext::DEFAULT_PARAMS constant (rather than a .dup copy) permanently sets VERIFY_NONE for the entire puma process lifetime, not just the LDAP connection. No public exploit identified at time of analysis, but the exact one-line fix is visible in the public commit diff, making the vulnerability trivially reproducible.
TLS certificate validation bypass in rsync enables on-path attackers to intercept and tamper with encrypted file transfer sessions. Affected are rsync 3.2.0-3.2.3 in openssl mode and rsync-ssl through 3.4.4 in stunnel mode; both fail to validate server certificates against a trusted CA and perform no hostname verification, allowing a self-signed or otherwise invalid certificate to be accepted silently. No public exploit has been identified at time of analysis, and a vendor-released patch (v3.5.0, designated a major security release) is available.
QUIC server listener in OpenSSL 3.5.x through 4.0.x allows remote unauthenticated denial of service through unbounded memory growth when processing QUIC Initial packets. Remote peers can flood the listener with Initial packets carrying novel Destination Connection IDs faster than the application drains the queue via SSL_accept(), causing per-channel state objects to accumulate without limit and exhausting process memory. No public exploit code or CISA KEV listing has been identified; vendor-confirmed patches are available in OpenSSL 3.5.8, 3.6.4, and 4.0.2.
Cleartext storage in PostgreSQL's pgcrypto extension silently exposes PGP-encrypted data as recoverable plaintext when OpenSSL disables the requested cipher, affecting all eight PGP encryption and decryption functions (pgp_sym_encrypt/decrypt, pgp_pub_encrypt/decrypt, and their bytea variants) across PostgreSQL 14 through 18. Beyond confidentiality loss, the same code path defeats the Modification Detection Code (MDC) integrity check, allowing decryption to succeed with an incorrect key - enabling an attacker to inject attacker-controlled plaintext through applications that accept encrypted data as input. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified; fix versions are clearly defined as 18.5, 17.11, 16.15, 15.19, and 14.24.
Memory exhaustion in Coturn's DTLS listener allows unauthenticated remote attackers to crash or degrade the TURN/STUN service by flooding it with fragmented DTLS ClientHello messages before cookie validation occurs. All Coturn deployments prior to version 4.16.0 are affected, as both dtls_server_input_handler() and create_new_connected_udp_socket() in dtls_listener.c retain OpenSSL reassembly state for attacker-declared inflated handshake lengths without first completing RFC 6347 cookie exchange. No public exploit has been identified at time of analysis, but the attack requires only UDP connectivity to the listener and no credentials whatsoever, making it accessible to any internet-facing adversary.
NULL pointer dereference in Crypt::OpenSSL::PKCS12 before version 1.98 for Perl enables process crashes when any caller invokes info_as_hash() on a crafted PKCS#12 file containing a zero-length BMPSTRING bag attribute. The root cause is a zero-size Renew() call that Perl's memory allocator implements as a free() returning NULL, which is subsequently dereferenced inside strlen() within a call to newSVpvn(). With no public exploit identified at time of analysis and an EPSS of 0.19%, active exploitation is currently unlikely, though any service that parses attacker-supplied PKCS#12 data and calls info_as_hash() is directly exposed to denial of service.
Memory exhaustion denial-of-service in OpenSSL 3.6.0-3.6.3 and 4.0.0-4.0.1 allows a malicious TLS server to leak attacker-tunable amounts of heap memory per handshake in connecting client applications that have explicitly enabled OCSP staple verification. By delivering a syntactically valid BasicOCSPResponse containing an empty SingleResponse sequence - optionally padded with bogus certificates to amplify each allocation - the server causes the internal OCSP_BASICRESP structure to be allocated but never freed, bypassing the cleanup path. No public exploit has been identified at time of analysis and no CISA KEV listing exists; risk is bounded by the non-default OCSP flag requirement.
PKCS#7 EnvelopedData decryption in the Python cryptography library (versions 44.0.0-49.x) leaks a Bleichenbacher oracle through four distinguishable error messages and timing side-channels during RSA PKCS#1 v1.5 key unwrapping, exposing the exact recovered plaintext length in one case. An attacker who can submit crafted EnvelopedData to an auto-decrypting service - such as an S/MIME gateway or mail filter that reflects outcomes at high volume - can adaptively recover the content-encryption key and decrypt intercepted messages. No public exploit has been identified at time of analysis, and exploitation requires very specific deployment conditions; the fix in version 50.0.0 applies RFC 3218 indistinguishability by substituting a random key on any failure.
DLL hijacking in Zucchetti FirmaCheck for Windows before 1.3.16 allows local low-privileged attackers to achieve arbitrary code execution at the privilege level of the FirmaCheck startup process. FirmaCheck.exe loads OpenSSL configuration from the unvalidated path C:\Program Files (x86)\Common Files\SSL\ without verifying the integrity or ownership of the directory; an attacker who can write to this location may plant a crafted openssl.cnf referencing an attacker-controlled DLL, which is then loaded automatically when FirmaCheck runs at system startup. No public exploit code or active exploitation has been identified at time of analysis; exploitation is reported by VulnCheck and is bounded by the local access requirement.
TLS server-identity verification bypass in FreeRDP 3.x (all versions <= 3.28.0) lets a network attacker positioned between an RDP client and server defeat certificate hostname validation. Because tls_verify_certificate()/tls_match_hostname()/x509_utils_get_dns_names() perform custom Common Name and DNS SAN string matching instead of OpenSSL's length-aware identity APIs, NUL-truncated SAN values, CN acceptance despite non-matching SANs, and IP-literal matching without iPAddress SAN comparison all pass verification. Reported by VulnCheck with a vendor patch (3.29.0); no public exploit identified at time of analysis and it is not on CISA KEV.
TLS server-authentication bypass in FreeRDP RDP client versions 3.28.0 and earlier lets a man-in-the-middle present a wildcard certificate (*.example.com) that is wrongly accepted for multi-label subdomains such as a.b.example.com. The flaw lives in tls_match_hostname() in libfreerdp/crypto/tls.c, which treats a wildcard as matching any hostname ending in the parent domain - behavior stricter OpenSSL X509_check_host() rejects. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.
Denial of service in Erlang/OTP's TLS handshake allows remote unauthenticated attackers to crash the BEAM VM by sending a crafted X.509 certificate chain. The vulnerability affects OTP versions 26.2 through 29.0.3 and specific patch releases of 27 and 28, exploiting unbounded growth of the policy tree during path validation. No active exploitation or public exploit code is known at this time, but the attack is automatable and has a high CVSS score.
Client-side denial-of-service in libssh2 through 1.11.1 allows a malicious SSH server to crash any connecting client before authentication by triggering an integer underflow during AES-GCM cipher negotiation, causing an out-of-bounds read and a near-SIZE_MAX memcpy that immediately terminates the process.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.4) lets unauthenticated attackers log in as any user, including administrators. The flaw stems from mo_saml_validate_signature() applying a loose boolean check to the tri-state integer returned by PHP's openssl_verify(), so the error value -1 is treated as truthy and accepted as a valid signature. Reported by Wordfence with a CVSS of 9.8; no public exploit has been identified at time of analysis, though the root cause and vulnerable code lines are publicly documented in the plugin source.
Improper TLS certificate validation in Gitea versions prior to 1.27.0 lets an on-path attacker intercept the internal API channel and steal the static, high-privilege INTERNAL_TOKEN. The internal API HTTP client (modules/private/internal.go) hardcodes InsecureSkipVerify:true with no config override, so gitea serv / gitea hook subprocesses accept any certificate when LOCAL_ROOT_URL uses HTTPS to a non-loopback host. A detailed proof-of-concept is published in the vendor advisory, but there is no evidence of active exploitation; the token grants full control over every /api/internal/* endpoint, including server shutdown, SSH key authorization, and arbitrary git command execution.
Integrity-protection bypass in libssh builds compiled against the OpenSSL crypto backend, caused by incorrect AES-GCM finalization checks that fail to verify the authentication tag. An in-path (man-in-the-middle) attacker positioned on an SSH session can silently alter plaintext bytes on the wire without triggering a MAC/integrity failure, defeating a core guarantee of the SSH transport layer. There is no public exploit identified at time of analysis, EPSS risk is low (0.28%, 20th percentile), and CISA SSVC rates exploitation as 'none' though 'automatable: yes'.
Heap out-of-bounds read in the Crypt::OpenSSL::X509 Perl module (versions before 2.1.3) lets a crafted X.509 certificate leak adjacent heap memory to an application that enumerates certificate extensions. When code calls extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_oid(), a certificate extension whose textual OID exceeds the fixed 129-byte buffer causes the returned hash key to include bytes read past the allocation, exposing process memory and risking a crash. No public exploit is identified at time of analysis and it is not in CISA KEV, but the fix is confirmed in release 2.1.3 and the flaw is trivially triggerable by any attacker who can supply a certificate.
Denial of service in the Crypt::OpenSSL::X509 Perl module before 2.1.3 lets a malformed X.509 certificate crash any Perl process that parses it. Four helper functions (basicC, ia5string, auth_att, keyid_data) dereference NULL pointers returned by OpenSSL's X509V3_EXT_d2i() on unparseable extensions - and keyid_data/auth_att additionally deref an akid->keyid field that is legitimately NULL for an empty Authority Key Identifier (DER 30 00). There is no public exploit identified at time of analysis, but the fix commit and a clear crash mechanism are published; CVSS is 7.5 (availability-only).
Signature-verification bypass in YesWiki (v4.6.5 and earlier, ActivityPub-federated Bazar forms) lets an unauthenticated remote attacker forge a valid ActivityPub actor and have Create/Update/Delete activities processed as if properly signed. The flaw stems from HttpSignatureService::verifySignature() using a loose boolean check (!openssl_verify(...)) that treats openssl_verify()'s -1 internal-error return as success. A detailed proof-of-concept exists (publicly available exploit code exists) demonstrating full CRUD on Bazar entries; the issue is not in CISA KEV and no EPSS score was provided.
Heap-based buffer overflow in PHP's OpenSSL extension affects all maintained PHP branches (8.2.x, 8.3.x, 8.4.x, 8.5.x) when the AES key-wrap-with-padding (AES-WRAP-PAD) algorithm per RFC 5649 is invoked. The output buffer is allocated based only on plaintext length, omitting the mandatory RFC 5649 padding expansion, causing OpenSSL to write beyond the allocated heap region, corrupt heap metadata, and abort the process. No public exploit has been identified at time of analysis; vendor-released patches are available for all affected branches.
Authentication bypass in 9router (>= 0.2.21 through 0.4.41) lets any unauthenticated remote attacker forge a valid dashboard session cookie because the JWT signing key falls back to the publicly committed hardcoded string "9router-default-secret-change-me" whenever the JWT_SECRET environment variable is unset. Since this secret is identical across every release and visible in the public repository, an attacker can pre-compute a valid auth_token, bypass the /dashboard login, and reach every API endpoint to steal stored API keys and auth tokens or take over the instance. Publicly available exploit code exists (the advisory ships a working jose-based PoC); there is no CISA KEV listing and no confirmed active exploitation at time of analysis.
Apify API token exfiltration in @apify/actors-mcp-server 0.10.7 lets a remote attacker steal a victim's bearer credential via URL authority injection (CWE-918/SSRF). Because getActorMCPServerURL() naively concatenates a trusted standby base URL with an attacker-controlled webServerMcpPath from an Actor definition, an Actor published with a value like '@attacker.example/mcp' causes the WHATWG URL parser to resolve the outbound connection to the attacker's host, and connectMCPClient() unconditionally forwards the victim's 'Authorization: Bearer <APIFY_TOKEN>' header there. Publicly available exploit code exists (a Docker-based PoC that captures the token on an attacker HTTPS server); no active exploitation is confirmed.
Arbitrary host file write in Incus before 7.1.0 lets a holder of S3 bucket credentials escape the storage volume via a path-traversal-laden multipart upload ID and plant files anywhere the daemon (typically root) can write, escalating to remote code execution. The flaw lives in the local S3 storage backend's multipart upload handling, where the attacker-supplied uploadId is concatenated onto the uploads directory without sanitization. A complete working PoC exists that drops a /etc/cron.d job for root command execution; no CISA KEV listing or EPSS score is provided, so this is publicly available exploit code rather than confirmed active exploitation.
Privilege escalation to AWS IAM and PKI compromise in Netflix Lemur 1.9.0 (and earlier) lets any SSO-authenticated, low-privilege user chain an ACME acme_url SSRF with a creator-equality IDOR to steal the worker's AWS STS credentials and retain permanent access to issued TLS private keys. Because Lemur auto-provisions new SSO identities as active=True, any holder of a trusted federated identity can reach the vulnerable authority-creation and key-fetch endpoints. A detailed, fully reproduced proof-of-concept (Docker lab plus asciinema recording) exists publicly, though there is no public exploit identified as being used in active attacks and the issue is fixed in 1.9.2.
Server-Side Request Forgery in Netflix Lemur's certificate verification pipeline allows an authenticated operator-role user to force the Lemur host to issue outbound HTTP requests to arbitrary internal destinations by uploading a crafted certificate whose CRL Distribution Point or OCSP responder extensions point to RFC1918 addresses, link-local endpoints (169.254.169.254), internal Kubernetes API servers, or loopback interfaces. Both `crl_verify` and `ocsp_verify` in `lemur/certificates/verify.py` pass attacker-controlled URLs directly to network sinks with no destination allow-list, scheme restriction beyond LDAP rejection, or private-address filtering. No public exploit confirmed in CISA KEV, but detailed proof-of-concept reproduction steps are published in the GitHub Security Advisory GHSA-54vg-pfh7-jq95; vendor-released patch v1.9.2 is available.
HMAC tag forgery in wolfSSL's OpenSSL-compatibility layer allows a zero-length or arbitrarily truncated HMAC tag to pass verification in EVP_DigestVerifyFinal, undermining message authentication for any application relying on this API path. Applications compiled with the OPENSSL_EXTRA flag that use EVP_DigestVerifyFinal for HMAC verification - including JWT validation libraries and message authentication flows - are affected across all currently-known wolfSSL versions. The root length check only enforced that the supplied tag did not exceed the MAC size, not that it equaled it, so an attacker controlling the tag buffer or length argument could present an empty signature and bypass integrity verification. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
X.509 trust-chain bypass in wolfSSL's OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert/X509_verify_cert) allows an attacker to have an attacker-controlled certificate accepted as valid by presenting a chain that never reaches a configured trust anchor. The flaw affects only builds compiled with --enable-opensslextra whose applications perform certificate validation via the OpenSSL-compat X509_verify_cert() API using caller-supplied untrusted intermediates; for those deployments it is critical (CVSS 4.0 base 8.7, integrity impact only). There is no public exploit identified at time of analysis and it is not on CISA KEV, but an upstream fix is available via wolfSSL PR #10674.
Certificate chain validation bypass in wolfSSL's OpenSSL-compatibility layer permits a crafted intermediate CA certificate asserting CA:TRUE but missing the keyCertSign key usage bit to be accepted as a valid signing CA during path building. Affected deployments are those compiled with OPENSSL_EXTRA or OPENSSL_ALL that use the X509_verify_cert/X509_STORE API; native wolfSSL verification is entirely unaffected. No public exploit identified at time of analysis, and no CISA KEV listing exists, but the integrity risk is concrete for any application relying on wolfSSL's OpenSSL-compat path for mutual TLS or client certificate authentication.
Certificate trust-chain bypass in wolfSSL allows attackers to have an attacker-controlled certificate accepted as valid, but only in builds compiled with --enable-opensslextra where the application calls the OpenSSL-compatibility X509_verify_cert() with caller-supplied untrusted intermediates. The verifier returned success based on the last verified link instead of confirming the chain reaches a configured trust anchor, so a chain deeper than the maximum path depth (default 100) is accepted without ever validating against a trusted root. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; native wolfSSL TLS/DTLS and the default WOLFSSL_VERIFY_PEER handshake are unaffected.
Signature-verification bypass in wolfSSL's OpenSSL compatibility layer allows a degenerate (certs-only) PKCS#7 object - one with empty signerInfos and no actual signature - to be falsely reported as verified by wolfSSL_PKCS7_verify(). Applications using the PKCS7_verify() compat API to authenticate attacker-supplied PKCS#7/CMS bundles can be tricked into treating unsigned content as authentic, undermining integrity guarantees. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the underlying defect is a classic improper-signature-verification (CWE-347) issue with a CVSS 4.0 base score of 8.2.
Certificate chain validation bypass in wolfSSL's OpenSSL compatibility layer allows a network attacker to present a chain terminating at an untrusted intermediate they control, which is accepted as valid when X509_V_FLAG_PARTIAL_CHAIN is enabled. The flaw (CWE-295) resided in wolfSSL_X509_verify_cert, where the partial-chain fallback confirmed only that some intermediate was temporarily loaded into the CertManager during path building - not that the terminal certificate was in the caller's actual trust store. No public exploit code exists and no CISA KEV listing is present, but successful exploitation defeats certificate validation entirely, enabling impersonation or MITM in affected configurations.
Heap out-of-bounds read in the Perl module Crypt::OpenSSL::PKCS12 before version 1.96 lets a crafted PKCS#12 file leak adjacent process heap memory into Perl scalars when its attributes are printed. Because print_attribute() copies a UTF8STRING value with strncpy into a buffer sized to the exact declared length and never NUL-terminates it, downstream strlen()/newSVpvn() reads past the buffer end. No public exploit identified at time of analysis, EPSS is low (0.35%), and it is not on CISA KEV, but the SSVC framework flags it as automatable with partial technical impact.
Unauthenticated call-control abuse in pipecat-ai development runner (>=0.0.77, <1.4.0) allows remote attackers reaching an exposed `/ws` telephony WebSocket to inject an attacker-controlled `callSid` that the server then submits to Twilio, Telnyx, or Plivo REST APIs using the operator's own credentials, forcibly terminating victim calls. Publicly available exploit code exists (a full Dockerized PoC is published in the GHSA advisory) and the maintainers shipped a fix in v1.4.0; no CISA KEV listing at time of analysis.
Server-side request forgery in Gotenberg v8.33.0 and earlier allows remote unauthenticated attackers to coerce the server into making arbitrary outbound HTTP(S) requests and to disclose local image files by uploading a crafted DOCX to the /forms/libreoffice/convert endpoint. The flaw stems from LibreOffice automatically resolving external and local resources referenced in <img> tags during conversion, exposing internal networks and on-disk image files. Publicly available exploit code exists via the vendor's GHSA-2mrg-35hw-x3x9 advisory, though no CISA KEV listing or EPSS data is available at time of analysis.
mTLS bypass in Traefik v3.6.17 through v3.7.2 allows unauthenticated remote clients to reach backends protected by router-specific client-certificate policies by negotiating over HTTP/3 (QUIC). The QUIC TLS configuration selector performs only an exact, case-sensitive SNI map lookup, so wildcard host rules (e.g. `*.example.com`) and mixed-case SNI values fall back to the default TLS configuration, which typically does not require a client certificate, while the HTTP routing layer still dispatches the request to the protected backend. Publicly available exploit code exists in the GitHub Security Advisory GHSA-9cr8-q42q-g8m7, but there is no public exploit identified at time of analysis indicating active in-the-wild abuse.
Cryptographic primality validation in Deno's Node.js compatibility layer (versions <= 2.8.0) silently skips Miller-Rabin testing when `crypto.checkPrime`/`checkPrimeSync` is called with default options, causing crafted composites whose smallest prime factor exceeds 17,863 (e.g. 17,881 × 17,891) to be reported as prime. Remote attackers who control bignums fed into a victim Deno application can therefore smuggle composite values past validation, with no public exploit identified at time of analysis beyond the vendor-published reproducer.
Mutual-TLS bypass in Traefik v3.7.0 and v3.7.1 lets unauthenticated remote attackers reach backends protected by wildcard-router `TLSOptions` (for example `Host("*.example.com")` with `RequireAndVerifyClientCert`). The `SNICheck` domain-fronting middleware resolves TLS options for the HTTP `Host` header via exact map lookups only, so an attacker completing the TLS handshake under a permissive SNI on the same entrypoint can then send a `Host` header for the wildcard-protected backend and skip the client-certificate requirement. Publicly available exploit code exists in the GitHub Security Advisory PoC; this is independent of the prior HTTP/3 mTLS issue.
Authentication bypass in dhax/go-base Go REST API boilerplate (versions prior to commit cc82b974, merged May 17, 2026) allows remote unauthenticated attackers to forge JWT tokens for arbitrary users including administrators. The signing secret is hardcoded to the literal string 'random' in both the dev.env template and as a Viper default in cmd/serve.go, and publicly available exploit code exists in the advisory. No CISA KEV listing or EPSS data is provided, but the secret is trivially derivable from the public GitHub repository.
Cryptographic message forgery in OpenSSL (branches 3.0.x, 3.4.x, 3.5.x, 3.6.x, and 4.0.0) allows an attacker to craft CMS AuthEnvelopedData messages that pass authentication and are accepted as genuine, defeating the integrity guarantee of CMS authenticated encryption. Any application relying on OpenSSL's CMS layer to reject tampered or forged authenticated-envelope messages can be tricked into processing attacker-controlled content as trusted. There is no public exploit identified at time of analysis, EPSS is 0.00%, and CISA SSVC lists exploitation status as none, but the flaw is network-reachable with no privileges required.
Incorrect authentication tag processing for empty messages in OpenSSL's AES-GCM-SIV and AES-SIV cipher modes enables network-positioned attackers to bypass integrity guarantees on empty ciphertext, yielding limited confidentiality and integrity violations (CVSS 4.8, CWE-325). Affected branches span OpenSSL 3.0.x through 4.0.0, all patched in the OpenSSL 4.0.1 security release dated 2026-06-09. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Null pointer dereference in OpenSSL's password-based CMS decryption path enables remote denial of service against applications that process CMS EnvelopedData with password-based key derivation. The flaw affects a wide range of OpenSSL branches spanning 1.0.2 through 4.0.0, making the exposure surface unusually broad across long-term support and current releases. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS score of 5.9 (Medium) reflects the high attack complexity required to trigger the condition.
Integrity-check bypass in OpenSSL 3.4.x, 3.5.x, 3.6.x, and 4.0.0 allows PKCS#12 files protected with PBMAC1 to be accepted even when secured by dangerously short HMAC keys, undermining the authentication of the keystore contents. Vendor patches are available in 3.4.6, 3.5.7, 3.6.3, and 4.0.1, and no public exploit identified at time of analysis; EPSS is 0.00% and the issue is not on the CISA KEV list.
Denial of service in OpenSSL QUIC implementation allows remote unauthenticated attackers to exhaust server memory by sending crafted PATH_CHALLENGE frames that trigger unbounded memory growth in the QUIC handler. The flaw affects OpenSSL branches 3.4.x, 3.5.x, 3.6.x, and 4.0.0, and is fixed in the 4.0.1 security release alongside numerous other CVEs. No public exploit identified at time of analysis and EPSS is very low (0.02%), but the network-reachable, no-auth nature of QUIC server endpoints makes the issue operationally relevant for TLS/QUIC-facing services.
Heap buffer overflow in OpenSSL's ASN.1 multibyte string conversion routine allows remote attackers to corrupt memory and potentially achieve code execution against applications using affected OpenSSL versions prior to 4.0.1. The flaw was disclosed via the OpenSSL 4.0.1 security patch release alongside 17 other CVEs and is classified as a high-severity issue (CVSS 8.1) with no public exploit identified at time of analysis.
Denial of service in OpenSSL 3.6.0-3.6.2 and 4.0.0 allows remote attackers to crash applications by triggering a NULL pointer dereference during certificate verification when OCSP checking is enabled. The flaw is patched in OpenSSL 4.0.1 (and 3.6.3) per the vendor's 2026-06-09 security advisory; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial-of-service in OpenSSL's ASN.1 content parser allows remote unauthenticated attackers to trigger a heap buffer over-read that can crash applications relying on the library for cryptographic parsing. Disclosed via the OpenSSL 4.0.1 security release on 2026-06-09 alongside more than a dozen other fixes, this issue affects every supported branch from 1.0.2 through 3.6 and 4.0. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the broad install base of OpenSSL across servers, clients, and embedded devices makes patching a priority.
Out-of-bounds read in OpenSSL 4.0.0's `X509_VERIFY_PARAM_set1_email()` function can crash applications performing email-based X.509 certificate verification when processing attacker-influenced email input, resulting in a denial-of-service condition. The vulnerability is scoped to OpenSSL 4.0.0 only and was patched in the June 9, 2026 security release (4.0.1), which bundled fixes for 18 CVEs. No public exploit identified at time of analysis and no CISA KEV listing.
Trust anchor substitution in OpenSSL's CMP rootCaKeyUpdate handler allows a network-positioned attacker with low privileges to bypass certificate validation via a cert/issuer field confusion bug (CWE-295), affecting four actively maintained OpenSSL branches. The high confidentiality impact (C:H) reflects the potential for a substituted malicious trust anchor to undermine TLS certificate chains, enabling downstream interception of protected communications. No public exploit identified at time of analysis; vendor patch released 2026-06-09 across all affected branches.
Denial of service in OpenSSL 3.5.x, 3.6.x, and 4.0.0 stems from a NULL pointer dereference triggered during QUIC server initial packet handling, allowing remote unauthenticated attackers to crash affected servers by sending crafted QUIC traffic. The flaw was disclosed via the OpenSSL 4.0.1 security release on 2026-06-09 alongside multiple other CVEs; no public exploit identified at time of analysis and no CISA KEV listing. Patched versions are available from the upstream project and downstream distributions including Ubuntu (USN-8414-1).
FFC-DH peer validation in OpenSSL incorrectly accepts an attacker-supplied `q` (subgroup order) parameter instead of using the locally trusted value, undermining the cryptographic integrity of Diffie-Hellman key exchange. Affected branches span OpenSSL 3.0.x, 3.4.x, 3.5.x, 3.6.x, and 4.0.0, with patched releases issued across all five branches on 2026-06-09. With a CVSS score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) and no confirmed active exploitation or public proof-of-concept, this is a moderate-priority patch item rather than an emergency response trigger - though its broad reach across widely deployed OpenSSL branches warrants timely remediation.
Bleichenbacher oracle in OpenSSL's CMS_decrypt() and PKCS7_decrypt() functions exposes RSA-encrypted message content to unauthenticated remote attackers who can submit adaptive chosen-ciphertext queries against multi-RecipientInfo CMS/PKCS7 structures. Four active OpenSSL branches are affected (3.4.x, 3.5.x, 3.6.x, and 4.0.x), with patches released under the coordinated OpenSSL security advisory on 2026-06-09. No public exploit code and no active exploitation have been identified at time of analysis; SSVC rates this non-automatable with partial technical impact, consistent with the attack's high operational complexity.
Confidentiality break in OpenSSL's AES-OCB implementation stems from the EVP_Cipher() code path ignoring the caller-supplied initialization vector (IV), causing the cipher to operate with a fixed/default IV instead. Affected branches include 3.0.x prior to 3.0.21, 3.4.x prior to 3.4.6, 3.5.x prior to 3.5.7, 3.6.x prior to 3.6.3, and 4.0.0, fixed in OpenSSL 4.0.1 and corresponding maintenance releases. With no public exploit identified at time of analysis and no CISA KEV listing, the issue is rated High (CVSS 7.5) due to high confidentiality impact via network-reachable cryptographic operations.
NULL pointer dereference in OpenSSL's CRMF EncryptedValue decryption path crashes the affected process, creating a remotely triggerable denial-of-service condition across five actively maintained OpenSSL branches (3.0.x, 3.4.x, 3.5.x, 3.6.x, and 4.0.x). The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, score 5.9) confirms network reachability with no authentication required, but high attack complexity limits trivial mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the broad version coverage and OpenSSL's ubiquitous deployment make patching a priority for any infrastructure using certificate management protocols.