OpenSSL

Cryptographic integrity bypass and weak key derivation in the openssl-encrypt Python package (jahlives) before 1.4.9 let an attacker with physical write access to a portable USB drive plant an undetected root-level autorun payload and precompute the drive encryption key offline. The integrity verifier only checks manifest-listed files, so added files pass verification, while a hard-coded fallback KDF salt (_LEGACY_FIXED_SALT) enables an offline rainbow-table attack against drives lacking a per-drive salt. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Path traversal in the openssl-encrypt pip package (versions before 1.4.9) enables a sandboxed plugin to escape its intended isolation and access or modify a sibling plugin's files when the two plugin directories share a name prefix. The flaw in PluginSandbox._is_safe_path performs a bare string-prefix match rather than an exact directory boundary comparison, so a plugin allowed under .../plugins/foo incorrectly passes the safety check for .../plugins/foobar. Vendor-released patch version 1.4.9 corrects the flaw; no public exploit code has been identified and the package is absent from the CISA KEV catalog.

Credential exposure in the openssl-encrypt pip package (versions ≤ 1.4.8) leaks keyserver bearer tokens in cleartext to stderr when the --debug flag is active. The root cause is a gap in sanitize_argv_for_debug(), which fails to redact the token supplied as a positional argument to the 'keyserver set-token' subcommand, leaving it visible in terminal output, CI/CD build logs, and shell history. Fixed in version 1.4.9; no public exploit identified at time of analysis, but credential exposure is immediately actionable for any attacker with access to affected log sources.

Signature-trust bypass in the openssl_encrypt Python library (PyPI 'openssl-encrypt') versions 1.4.8 and earlier lets an attacker get a forged GPG key enrolled as a plugin-signing trust anchor. Because enroll_trust_key matches key fingerprints with a suffix-tolerant comparison, an operator who verifies only a short (~32-bit, forgeable) GPG key id can be tricked into trusting an attacker-controlled colliding key, which then validly signs malicious plugins even under the strict ENFORCE signature policy. No CISA KEV listing and no public exploit identified at time of analysis; the fix is in 1.4.9.

Cleartext password leakage in openssl-encrypt before 1.4.9 exposes file encryption credentials in debug output when passwords are supplied via bundled short-option or abbreviated long-option argument forms. The tool's sanitizer, which is designed to redact sensitive arguments before writing the argv dump to stderr, fails to recognize spellings like -apHunter2 (bundled short option) or --passw (abbreviated long option), causing the raw password to appear in terminal scrollback, CI job logs, and persistent GUI debug logs. No public exploit identified at time of analysis; the vulnerability is trivially exploitable by any party with read access to the affected log output.

Key derivation function downgrade in openssl-encrypt pip package (versions ≤ 1.4.8) allows an attacker who pre-positions a crafted crypt_settings.json in the victim's process launch directory to silently collapse encryption to a single SHA-256 round, rendering resulting ciphertext trivially brute-forceable offline. A regression at line 84 of crypt_settings.py reassigns CONFIG_FILE from the intended absolute home-directory path to a bare relative filename, causing the legacy Tk GUI's SettingsTab to consume attacker-controlled KDF parameters instead of the user's legitimate settings. No public exploit is identified at time of analysis; vendor-released patch is available as version 1.4.9.

Verdict spoofing in the openssl-encrypt pip package (versions <= 1.4.8) lets an attacker who controls the contents of a scanned drive forge a PASSED tamper-check result. Because filenames read from untrusted drive data are printed by the verify-usb command without neutralizing terminal control bytes, crafted names containing cursor-movement and erase-line sequences can repaint the screen to hide genuine tamper detection. There is no public exploit identified at time of analysis and it is not in CISA KEV; the issue is fixed in 1.4.9, which routes drive-derived names through sanitize_for_display().

Uncontrolled memory allocation in the openssl-encrypt Python package (pip, versions ≤1.4.8) exposes any service invoking its `decrypt --stego-extract` command to unauthenticated denial of service via a crafted FLAC file. The STREAMINFO total_samples field - a 36-bit value fully controlled by the file author - is passed without bounds validation directly to NumPy as an array dimension, causing allocations of tens of gigabytes from a ~50-byte input. A vendor-released patch exists in version 1.4.9; no public exploit code has been identified at time of analysis, though the attack requires no authentication and minimal complexity.

Symlink-following in the openssl-encrypt pip package (jahlives/openssl_encrypt) before 1.4.9 allows an evil-maid attacker with physical access to a target USB drive to bypass the verify-usb v2 integrity check and achieve code execution on the victim's machine. The attacker replaces a tool-tree directory with a symlink to a crafted copy that includes byte-identical visible source files and a planted __pycache__/*.pyc compiled bytecode file; CPython's rglob() does not enumerate symlinked directory contents, so the planted file is never counted, verify-usb reports PASSED, and the malicious bytecode executes when the victim launches the portable install. No public exploit has been identified at time of analysis, and the attack is gated behind physical drive access and victim interaction.

Local information disclosure in the openssl-encrypt pip package (versions ≤ 1.4.8) exposes steganography passwords to all unprivileged users on the same Linux host. When the desktop GUI initiates an encrypt or decrypt operation involving the steganography feature, it spawns a CLI child process with the password supplied as the `--stego-password` command-line argument rather than via an environment variable, making it readable from `/proc/<pid>/cmdline` for the entire subprocess lifetime by any local user. The main encryption password is handled correctly via environment variable and is unaffected. A vendor-released patch is available in version 1.4.9; no public exploit has been identified at time of analysis.

Cleartext private key exposure in openssl-encrypt (pip package by jahlives) versions 1.4.8 and earlier allows any local user to read a stored mTLS client private key from a world-readable SharedPreferences file. The desktop GUI's Settings screen writes the combined certificate and private key PEM directly into a 0644-permissioned file, making it accessible to all local users on the system without elevated privileges. No public exploit or CISA KEV listing exists at time of analysis, but the trivial exploitation path (read a world-readable file) means any local user on an affected host can silently exfiltrate the private key and use it to impersonate the legitimate mTLS client.

Sensitive-file exposure in the openssl-encrypt pip package (openssl_encrypt) at versions <= 1.4.8 stems from its 'Encrypted USB Workspace' feature writing a marker that falsely declares the workspace AES-256-GCM encrypted while the derived key is never applied and the directory remains in cleartext. Users who trust the branding and store files in the workspace leave them fully readable on the removable media, so anyone with physical possession of the USB device can recover the data. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the failure silently defeats the product's core security promise.

Remote denial of service in OpenSSL's CMP subsystem affects versions 3.0.x through 4.0.x when password-based MAC (PBM)-protected messages are processed, caused by a missing ASN.1 type check that allows a crafted message to trigger an invalid pointer dereference before any MAC computation occurs. Unauthenticated remote attackers (CVSS PR:N) can crash applications acting as CMP servers via OSSL_CMP_SRV_process_request(), or crash CMP clients communicating with a malicious or intercepted CMP server. No public exploit has been identified at time of analysis; SSVC rates current exploitation as none, though the attack is rated automatable and requires no knowledge of the PBM shared secret.

Memory exhaustion in OpenSSL's QUIC stack allows any remote peer that completes a QUIC handshake to cause unbounded connection-scoped memory growth by sending repeated PING frames while withholding acknowledgments for ack-eliciting packets. Affected versions span OpenSSL 3.4.0 through early 4.0.x; TLS-only deployments and the FIPS module are unaffected. No public exploit code exists and SSVC confirms no active exploitation at time of analysis, though the attack is rated automatable (CVSS AV:N/AC:L/PR:N/UI:N), making concurrent-connection amplification straightforward.

Unbounded memory growth in OpenSSL's Certificate Management Protocol (CMP) implementation enables unauthenticated remote attackers to exhaust server memory by repeatedly sending rejected CMP messages containing large extraCerts lists. Affected are OpenSSL 3.0.x before 3.0.22, 3.4.x before 3.4.7, 3.5.x before 3.5.8, 3.6.x before 3.6.4, and 4.0.x before 4.0.2 - but only when the CMP server shares a single long-lived OSSL_CMP_CTX across requests. Vendor patches are available; SSVC classifies exploitation as 'none' and no public exploit code has been identified at time of analysis.

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as "CN=%s%n" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.

Heap corruption in OpenSSL's CMS decryption path allows a remote unauthenticated attacker to crash any application invoking CMS_decrypt() on attacker-supplied ciphertext. The AES-WRAP-PAD unwrap primitive writes and cleanses up to the full input length on its integrity-failure path, while the CMS layer allocates a buffer sized only for the expected output - producing a fixed-size, fixed-value (zero) 8-byte overwrite immediately past the heap allocation. No public exploit has been identified at time of analysis, but the CVSS 7.5 rating and SSVC automatable classification indicate this can be reliably triggered at scale against any service that processes externally sourced CMS messages.

DTLS memory exhaustion in OpenSSL allows unauthenticated remote peers to consume disproportionate server memory during handshake processing. Sending small forged records that claim a future epoch triggers OpenSSL to buffer the entire ~16 KB read buffer rather than just the actual record bytes, yielding an amplification factor of approximately 1,200× per record; up to 100 such records may be queued per connection, exposing roughly 1.7 MB of server memory per association from a negligible volume of transmitted data. No public exploit has been identified at time of analysis and SSVC rates exploitation status as none, but the attack is rated automatable and can be multiplied across many concurrent DTLS connections.

Remote unauthenticated denial of service in OpenSSL's QUIC server stack (versions 3.5.x before 3.5.8, 3.6.x before 3.6.4, and 4.0.x before 4.0.2) allows an attacker to crash the QUIC server process by sending a single malformed INITIAL packet with a destination connection ID shorter than 8 bytes. The crafted packet triggers a double-free of the QUIC record layer RX (QRX) object, causing heap corruption and process termination. No public exploit has been identified; remote code execution is explicitly assessed as highly improbable by the vendor, and no public exploit or active exploitation has been confirmed.

NULL pointer dereference in OpenSSL's RFC7250 Raw Public Key (RPK) TLS extension handling crashes any server or client configured in key-only RPK mode when a remote peer sends the typically omitted `signature_algorithms_cert` extension. Affected versions span OpenSSL 3.4.x through 4.0.x; impact is strictly limited to a process-aborting Denial of Service - no data disclosure or code execution is possible. No public exploit exists and CISA SSVC rates active exploitation as none, but the attack is automatable against any reachable endpoint in this non-default configuration.

Unauthenticated authentication bypass in miniOrange's SAML Single Sign-On extensions for Joomla (SAML SSO < 11.0.2, SAML SP Login with ADFS < 6.4, and SAML SSO login with Google Apps < 6.4) lets remote attackers log in as any Joomla account, including administrators. The mo_saml_validate_signature() function treats OpenSSL's -1 error return as a successful signature verification, so a crafted SAMLResponse with an attacker-chosen NameID and a deliberately malformed signature bypasses validation entirely. Rated CVSS 4.0 10.0; no public exploit identified at time of analysis, but the flaw is trivially reachable and yields full site takeover.

Cleartext transmission of TYPO3 system information occurs in the Syssy - TYPO3 Monitoring & Security Checks extension when OpenSSL is absent on the hosting server, exposing potentially sensitive configuration and system data to network interception (CWE-319). All tracked versions of the extension are affected per CPE data, though exploitation is constrained by the dual requirement of OpenSSL being unavailable and the attacker already possessing the SYSSY project's API key. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 5.3 reflects the medium-severity, partially-authenticated nature of the flaw.

TLS hostname verification is silently bypassed in Netty's OpenSSL client path, allowing a network man-in-the-middle attacker to intercept encrypted communications by presenting a certificate issued for a different hostname. Affected are applications using io.netty:netty-handler versions 4.2.0.Final through 4.2.16.Final or any 4.1.x through 4.1.136.Final, specifically when the SslProvider.OPENSSL client path is configured with a plain X509TrustManager and running on Java 25 or later, where Unsafe-based trust-manager wrapping is unavailable. No public exploit code has been identified at time of analysis, but the confidentiality impact is high for any affected deployment that transmits sensitive data over TLS.

Stack exhaustion in the Picotls minicrypto backend's custom ASN.1 validator allows an attacker who can supply crafted private-key material to crash any application that calls ptls_minicrypto_load_private_key() or the public ptls_asn1_validation() API on untrusted DER input. All Picotls versions prior to upstream commit c14231d80 are affected when the minicrypto backend is in use; applications using the libcrypto (OpenSSL) backend are immune because OpenSSL performs its own bounded DER parsing. No public exploit has been identified and no CISA KEV listing exists; CVSS 5.5 reflects a local, user-interaction-dependent denial-of-service with no code execution potential.

Global SSL/TLS certificate verification is silently disabled across all puma web process outbound connections in Mastodon when LDAP authentication is configured with LDAP_TLS_NO_VERIFY=true, enabling man-in-the-middle interception of federation traffic, API callbacks, and media fetches. Affecting versions prior to 4.4.19 and 4.5.0 through 4.5.11, the root cause is a Ruby object mutation defect: calling .tap directly on the shared global OpenSSL::SSL::SSLContext::DEFAULT_PARAMS constant (rather than a .dup copy) permanently sets VERIFY_NONE for the entire puma process lifetime, not just the LDAP connection. No public exploit identified at time of analysis, but the exact one-line fix is visible in the public commit diff, making the vulnerability trivially reproducible.

TLS certificate validation bypass in rsync enables on-path attackers to intercept and tamper with encrypted file transfer sessions. Affected are rsync 3.2.0-3.2.3 in openssl mode and rsync-ssl through 3.4.4 in stunnel mode; both fail to validate server certificates against a trusted CA and perform no hostname verification, allowing a self-signed or otherwise invalid certificate to be accepted silently. No public exploit has been identified at time of analysis, and a vendor-released patch (v3.5.0, designated a major security release) is available.

QUIC server listener in OpenSSL 3.5.x through 4.0.x allows remote unauthenticated denial of service through unbounded memory growth when processing QUIC Initial packets. Remote peers can flood the listener with Initial packets carrying novel Destination Connection IDs faster than the application drains the queue via SSL_accept(), causing per-channel state objects to accumulate without limit and exhausting process memory. No public exploit code or CISA KEV listing has been identified; vendor-confirmed patches are available in OpenSSL 3.5.8, 3.6.4, and 4.0.2.

Cleartext storage in PostgreSQL's pgcrypto extension silently exposes PGP-encrypted data as recoverable plaintext when OpenSSL disables the requested cipher, affecting all eight PGP encryption and decryption functions (pgp_sym_encrypt/decrypt, pgp_pub_encrypt/decrypt, and their bytea variants) across PostgreSQL 14 through 18. Beyond confidentiality loss, the same code path defeats the Modification Detection Code (MDC) integrity check, allowing decryption to succeed with an incorrect key - enabling an attacker to inject attacker-controlled plaintext through applications that accept encrypted data as input. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified; fix versions are clearly defined as 18.5, 17.11, 16.15, 15.19, and 14.24.

Memory exhaustion in Coturn's DTLS listener allows unauthenticated remote attackers to crash or degrade the TURN/STUN service by flooding it with fragmented DTLS ClientHello messages before cookie validation occurs. All Coturn deployments prior to version 4.16.0 are affected, as both dtls_server_input_handler() and create_new_connected_udp_socket() in dtls_listener.c retain OpenSSL reassembly state for attacker-declared inflated handshake lengths without first completing RFC 6347 cookie exchange. No public exploit has been identified at time of analysis, but the attack requires only UDP connectivity to the listener and no credentials whatsoever, making it accessible to any internet-facing adversary.

NULL pointer dereference in Crypt::OpenSSL::PKCS12 before version 1.98 for Perl enables process crashes when any caller invokes info_as_hash() on a crafted PKCS#12 file containing a zero-length BMPSTRING bag attribute. The root cause is a zero-size Renew() call that Perl's memory allocator implements as a free() returning NULL, which is subsequently dereferenced inside strlen() within a call to newSVpvn(). With no public exploit identified at time of analysis and an EPSS of 0.19%, active exploitation is currently unlikely, though any service that parses attacker-supplied PKCS#12 data and calls info_as_hash() is directly exposed to denial of service.

Memory exhaustion denial-of-service in OpenSSL 3.6.0-3.6.3 and 4.0.0-4.0.1 allows a malicious TLS server to leak attacker-tunable amounts of heap memory per handshake in connecting client applications that have explicitly enabled OCSP staple verification. By delivering a syntactically valid BasicOCSPResponse containing an empty SingleResponse sequence - optionally padded with bogus certificates to amplify each allocation - the server causes the internal OCSP_BASICRESP structure to be allocated but never freed, bypassing the cleanup path. No public exploit has been identified at time of analysis and no CISA KEV listing exists; risk is bounded by the non-default OCSP flag requirement.

PKCS#7 EnvelopedData decryption in the Python cryptography library (versions 44.0.0-49.x) leaks a Bleichenbacher oracle through four distinguishable error messages and timing side-channels during RSA PKCS#1 v1.5 key unwrapping, exposing the exact recovered plaintext length in one case. An attacker who can submit crafted EnvelopedData to an auto-decrypting service - such as an S/MIME gateway or mail filter that reflects outcomes at high volume - can adaptively recover the content-encryption key and decrypt intercepted messages. No public exploit has been identified at time of analysis, and exploitation requires very specific deployment conditions; the fix in version 50.0.0 applies RFC 3218 indistinguishability by substituting a random key on any failure.

DLL hijacking in Zucchetti FirmaCheck for Windows before 1.3.16 allows local low-privileged attackers to achieve arbitrary code execution at the privilege level of the FirmaCheck startup process. FirmaCheck.exe loads OpenSSL configuration from the unvalidated path C:\Program Files (x86)\Common Files\SSL\ without verifying the integrity or ownership of the directory; an attacker who can write to this location may plant a crafted openssl.cnf referencing an attacker-controlled DLL, which is then loaded automatically when FirmaCheck runs at system startup. No public exploit code or active exploitation has been identified at time of analysis; exploitation is reported by VulnCheck and is bounded by the local access requirement.

TLS server-identity verification bypass in FreeRDP 3.x (all versions <= 3.28.0) lets a network attacker positioned between an RDP client and server defeat certificate hostname validation. Because tls_verify_certificate()/tls_match_hostname()/x509_utils_get_dns_names() perform custom Common Name and DNS SAN string matching instead of OpenSSL's length-aware identity APIs, NUL-truncated SAN values, CN acceptance despite non-matching SANs, and IP-literal matching without iPAddress SAN comparison all pass verification. Reported by VulnCheck with a vendor patch (3.29.0); no public exploit identified at time of analysis and it is not on CISA KEV.

TLS server-authentication bypass in FreeRDP RDP client versions 3.28.0 and earlier lets a man-in-the-middle present a wildcard certificate (*.example.com) that is wrongly accepted for multi-label subdomains such as a.b.example.com. The flaw lives in tls_match_hostname() in libfreerdp/crypto/tls.c, which treats a wildcard as matching any hostname ending in the parent domain - behavior stricter OpenSSL X509_check_host() rejects. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.

Denial of service in Erlang/OTP's TLS handshake allows remote unauthenticated attackers to crash the BEAM VM by sending a crafted X.509 certificate chain. The vulnerability affects OTP versions 26.2 through 29.0.3 and specific patch releases of 27 and 28, exploiting unbounded growth of the policy tree during path validation. No active exploitation or public exploit code is known at this time, but the attack is automatable and has a high CVSS score.

Client-side denial-of-service in libssh2 through 1.11.1 allows a malicious SSH server to crash any connecting client before authentication by triggering an integer underflow during AES-GCM cipher negotiation, causing an out-of-bounds read and a near-SIZE_MAX memcpy that immediately terminates the process.

Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.4) lets unauthenticated attackers log in as any user, including administrators. The flaw stems from mo_saml_validate_signature() applying a loose boolean check to the tri-state integer returned by PHP's openssl_verify(), so the error value -1 is treated as truthy and accepted as a valid signature. Reported by Wordfence with a CVSS of 9.8; no public exploit has been identified at time of analysis, though the root cause and vulnerable code lines are publicly documented in the plugin source.

Improper TLS certificate validation in Gitea versions prior to 1.27.0 lets an on-path attacker intercept the internal API channel and steal the static, high-privilege INTERNAL_TOKEN. The internal API HTTP client (modules/private/internal.go) hardcodes InsecureSkipVerify:true with no config override, so gitea serv / gitea hook subprocesses accept any certificate when LOCAL_ROOT_URL uses HTTPS to a non-loopback host. A detailed proof-of-concept is published in the vendor advisory, but there is no evidence of active exploitation; the token grants full control over every /api/internal/* endpoint, including server shutdown, SSH key authorization, and arbitrary git command execution.

Integrity-protection bypass in libssh builds compiled against the OpenSSL crypto backend, caused by incorrect AES-GCM finalization checks that fail to verify the authentication tag. An in-path (man-in-the-middle) attacker positioned on an SSH session can silently alter plaintext bytes on the wire without triggering a MAC/integrity failure, defeating a core guarantee of the SSH transport layer. There is no public exploit identified at time of analysis, EPSS risk is low (0.28%, 20th percentile), and CISA SSVC rates exploitation as 'none' though 'automatable: yes'.

Heap out-of-bounds read in the Crypt::OpenSSL::X509 Perl module (versions before 2.1.3) lets a crafted X.509 certificate leak adjacent heap memory to an application that enumerates certificate extensions. When code calls extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_oid(), a certificate extension whose textual OID exceeds the fixed 129-byte buffer causes the returned hash key to include bytes read past the allocation, exposing process memory and risking a crash. No public exploit is identified at time of analysis and it is not in CISA KEV, but the fix is confirmed in release 2.1.3 and the flaw is trivially triggerable by any attacker who can supply a certificate.

Denial of service in the Crypt::OpenSSL::X509 Perl module before 2.1.3 lets a malformed X.509 certificate crash any Perl process that parses it. Four helper functions (basicC, ia5string, auth_att, keyid_data) dereference NULL pointers returned by OpenSSL's X509V3_EXT_d2i() on unparseable extensions - and keyid_data/auth_att additionally deref an akid->keyid field that is legitimately NULL for an empty Authority Key Identifier (DER 30 00). There is no public exploit identified at time of analysis, but the fix commit and a clear crash mechanism are published; CVSS is 7.5 (availability-only).

Signature-verification bypass in YesWiki (v4.6.5 and earlier, ActivityPub-federated Bazar forms) lets an unauthenticated remote attacker forge a valid ActivityPub actor and have Create/Update/Delete activities processed as if properly signed. The flaw stems from HttpSignatureService::verifySignature() using a loose boolean check (!openssl_verify(...)) that treats openssl_verify()'s -1 internal-error return as success. A detailed proof-of-concept exists (publicly available exploit code exists) demonstrating full CRUD on Bazar entries; the issue is not in CISA KEV and no EPSS score was provided.

Root-privileged arbitrary directory creation and file write affects Note Mark (self-hosted notes application) versions <= v0.19.4, arising because book and note slug validation uses the unanchored huma OpenAPI pattern '[a-z0-9-]+', letting a low-privilege authenticated user store a path-traversal slug such as '../../../../etc/cron.d/x'. When an administrator later runs the 'note-mark migrate export' or 'export-v1' CLI (routinely as root in Docker), the exporter joins the raw slug into the output path and writes '_index.md' outside the export directory, enabling escalation to code execution as root. Publicly available exploit code exists (a version-pinned Go reproducer plus an end-to-end Docker walkthrough); this is the unpatched sibling of GHSA-g49p-4qxj-88v3 and is not listed in CISA KEV.

Heap-based buffer overflow in PHP's OpenSSL extension affects all maintained PHP branches (8.2.x, 8.3.x, 8.4.x, 8.5.x) when the AES key-wrap-with-padding (AES-WRAP-PAD) algorithm per RFC 5649 is invoked. The output buffer is allocated based only on plaintext length, omitting the mandatory RFC 5649 padding expansion, causing OpenSSL to write beyond the allocated heap region, corrupt heap metadata, and abort the process. No public exploit has been identified at time of analysis; vendor-released patches are available for all affected branches.

Authentication bypass in 9router (>= 0.2.21 through 0.4.41) lets any unauthenticated remote attacker forge a valid dashboard session cookie because the JWT signing key falls back to the publicly committed hardcoded string "9router-default-secret-change-me" whenever the JWT_SECRET environment variable is unset. Since this secret is identical across every release and visible in the public repository, an attacker can pre-compute a valid auth_token, bypass the /dashboard login, and reach every API endpoint to steal stored API keys and auth tokens or take over the instance. Publicly available exploit code exists (the advisory ships a working jose-based PoC); there is no CISA KEV listing and no confirmed active exploitation at time of analysis.

Apify API token exfiltration in @apify/actors-mcp-server 0.10.7 lets a remote attacker steal a victim's bearer credential via URL authority injection (CWE-918/SSRF). Because getActorMCPServerURL() naively concatenates a trusted standby base URL with an attacker-controlled webServerMcpPath from an Actor definition, an Actor published with a value like '@attacker.example/mcp' causes the WHATWG URL parser to resolve the outbound connection to the attacker's host, and connectMCPClient() unconditionally forwards the victim's 'Authorization: Bearer <APIFY_TOKEN>' header there. Publicly available exploit code exists (a Docker-based PoC that captures the token on an attacker HTTPS server); no active exploitation is confirmed.

Arbitrary host file write in Incus before 7.1.0 lets a holder of S3 bucket credentials escape the storage volume via a path-traversal-laden multipart upload ID and plant files anywhere the daemon (typically root) can write, escalating to remote code execution. The flaw lives in the local S3 storage backend's multipart upload handling, where the attacker-supplied uploadId is concatenated onto the uploads directory without sanitization. A complete working PoC exists that drops a /etc/cron.d job for root command execution; no CISA KEV listing or EPSS score is provided, so this is publicly available exploit code rather than confirmed active exploitation.

Privilege escalation to AWS IAM and PKI compromise in Netflix Lemur 1.9.0 (and earlier) lets any SSO-authenticated, low-privilege user chain an ACME acme_url SSRF with a creator-equality IDOR to steal the worker's AWS STS credentials and retain permanent access to issued TLS private keys. Because Lemur auto-provisions new SSO identities as active=True, any holder of a trusted federated identity can reach the vulnerable authority-creation and key-fetch endpoints. A detailed, fully reproduced proof-of-concept (Docker lab plus asciinema recording) exists publicly, though there is no public exploit identified as being used in active attacks and the issue is fixed in 1.9.2.

Server-Side Request Forgery in Netflix Lemur's certificate verification pipeline allows an authenticated operator-role user to force the Lemur host to issue outbound HTTP requests to arbitrary internal destinations by uploading a crafted certificate whose CRL Distribution Point or OCSP responder extensions point to RFC1918 addresses, link-local endpoints (169.254.169.254), internal Kubernetes API servers, or loopback interfaces. Both `crl_verify` and `ocsp_verify` in `lemur/certificates/verify.py` pass attacker-controlled URLs directly to network sinks with no destination allow-list, scheme restriction beyond LDAP rejection, or private-address filtering. No public exploit confirmed in CISA KEV, but detailed proof-of-concept reproduction steps are published in the GitHub Security Advisory GHSA-54vg-pfh7-jq95; vendor-released patch v1.9.2 is available.

HMAC tag forgery in wolfSSL's OpenSSL-compatibility layer allows a zero-length or arbitrarily truncated HMAC tag to pass verification in EVP_DigestVerifyFinal, undermining message authentication for any application relying on this API path. Applications compiled with the OPENSSL_EXTRA flag that use EVP_DigestVerifyFinal for HMAC verification - including JWT validation libraries and message authentication flows - are affected across all currently-known wolfSSL versions. The root length check only enforced that the supplied tag did not exceed the MAC size, not that it equaled it, so an attacker controlling the tag buffer or length argument could present an empty signature and bypass integrity verification. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.

X.509 trust-chain bypass in wolfSSL's OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert/X509_verify_cert) allows an attacker to have an attacker-controlled certificate accepted as valid by presenting a chain that never reaches a configured trust anchor. The flaw affects only builds compiled with --enable-opensslextra whose applications perform certificate validation via the OpenSSL-compat X509_verify_cert() API using caller-supplied untrusted intermediates; for those deployments it is critical (CVSS 4.0 base 8.7, integrity impact only). There is no public exploit identified at time of analysis and it is not on CISA KEV, but an upstream fix is available via wolfSSL PR #10674.

Certificate chain validation bypass in wolfSSL's OpenSSL-compatibility layer permits a crafted intermediate CA certificate asserting CA:TRUE but missing the keyCertSign key usage bit to be accepted as a valid signing CA during path building. Affected deployments are those compiled with OPENSSL_EXTRA or OPENSSL_ALL that use the X509_verify_cert/X509_STORE API; native wolfSSL verification is entirely unaffected. No public exploit identified at time of analysis, and no CISA KEV listing exists, but the integrity risk is concrete for any application relying on wolfSSL's OpenSSL-compat path for mutual TLS or client certificate authentication.

Certificate trust-chain bypass in wolfSSL allows attackers to have an attacker-controlled certificate accepted as valid, but only in builds compiled with --enable-opensslextra where the application calls the OpenSSL-compatibility X509_verify_cert() with caller-supplied untrusted intermediates. The verifier returned success based on the last verified link instead of confirming the chain reaches a configured trust anchor, so a chain deeper than the maximum path depth (default 100) is accepted without ever validating against a trusted root. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; native wolfSSL TLS/DTLS and the default WOLFSSL_VERIFY_PEER handshake are unaffected.

Signature-verification bypass in wolfSSL's OpenSSL compatibility layer allows a degenerate (certs-only) PKCS#7 object - one with empty signerInfos and no actual signature - to be falsely reported as verified by wolfSSL_PKCS7_verify(). Applications using the PKCS7_verify() compat API to authenticate attacker-supplied PKCS#7/CMS bundles can be tricked into treating unsigned content as authentic, undermining integrity guarantees. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the underlying defect is a classic improper-signature-verification (CWE-347) issue with a CVSS 4.0 base score of 8.2.

Certificate chain validation bypass in wolfSSL's OpenSSL compatibility layer allows a network attacker to present a chain terminating at an untrusted intermediate they control, which is accepted as valid when X509_V_FLAG_PARTIAL_CHAIN is enabled. The flaw (CWE-295) resided in wolfSSL_X509_verify_cert, where the partial-chain fallback confirmed only that some intermediate was temporarily loaded into the CertManager during path building - not that the terminal certificate was in the caller's actual trust store. No public exploit code exists and no CISA KEV listing is present, but successful exploitation defeats certificate validation entirely, enabling impersonation or MITM in affected configurations.

Heap out-of-bounds read in the Perl module Crypt::OpenSSL::PKCS12 before version 1.96 lets a crafted PKCS#12 file leak adjacent process heap memory into Perl scalars when its attributes are printed. Because print_attribute() copies a UTF8STRING value with strncpy into a buffer sized to the exact declared length and never NUL-terminates it, downstream strlen()/newSVpvn() reads past the buffer end. No public exploit identified at time of analysis, EPSS is low (0.35%), and it is not on CISA KEV, but the SSVC framework flags it as automatable with partial technical impact.

Unauthenticated call-control abuse in pipecat-ai development runner (>=0.0.77, <1.4.0) allows remote attackers reaching an exposed `/ws` telephony WebSocket to inject an attacker-controlled `callSid` that the server then submits to Twilio, Telnyx, or Plivo REST APIs using the operator's own credentials, forcibly terminating victim calls. Publicly available exploit code exists (a full Dockerized PoC is published in the GHSA advisory) and the maintainers shipped a fix in v1.4.0; no CISA KEV listing at time of analysis.

Server-side request forgery in Gotenberg v8.33.0 and earlier allows remote unauthenticated attackers to coerce the server into making arbitrary outbound HTTP(S) requests and to disclose local image files by uploading a crafted DOCX to the /forms/libreoffice/convert endpoint. The flaw stems from LibreOffice automatically resolving external and local resources referenced in <img> tags during conversion, exposing internal networks and on-disk image files. Publicly available exploit code exists via the vendor's GHSA-2mrg-35hw-x3x9 advisory, though no CISA KEV listing or EPSS data is available at time of analysis.

mTLS bypass in Traefik v3.6.17 through v3.7.2 allows unauthenticated remote clients to reach backends protected by router-specific client-certificate policies by negotiating over HTTP/3 (QUIC). The QUIC TLS configuration selector performs only an exact, case-sensitive SNI map lookup, so wildcard host rules (e.g. `*.example.com`) and mixed-case SNI values fall back to the default TLS configuration, which typically does not require a client certificate, while the HTTP routing layer still dispatches the request to the protected backend. Publicly available exploit code exists in the GitHub Security Advisory GHSA-9cr8-q42q-g8m7, but there is no public exploit identified at time of analysis indicating active in-the-wild abuse.

Cryptographic primality validation in Deno's Node.js compatibility layer (versions <= 2.8.0) silently skips Miller-Rabin testing when `crypto.checkPrime`/`checkPrimeSync` is called with default options, causing crafted composites whose smallest prime factor exceeds 17,863 (e.g. 17,881 × 17,891) to be reported as prime. Remote attackers who control bignums fed into a victim Deno application can therefore smuggle composite values past validation, with no public exploit identified at time of analysis beyond the vendor-published reproducer.

Mutual-TLS bypass in Traefik v3.7.0 and v3.7.1 lets unauthenticated remote attackers reach backends protected by wildcard-router `TLSOptions` (for example `Host("*.example.com")` with `RequireAndVerifyClientCert`). The `SNICheck` domain-fronting middleware resolves TLS options for the HTTP `Host` header via exact map lookups only, so an attacker completing the TLS handshake under a permissive SNI on the same entrypoint can then send a `Host` header for the wildcard-protected backend and skip the client-certificate requirement. Publicly available exploit code exists in the GitHub Security Advisory PoC; this is independent of the prior HTTP/3 mTLS issue.

Authentication bypass in dhax/go-base Go REST API boilerplate (versions prior to commit cc82b974, merged May 17, 2026) allows remote unauthenticated attackers to forge JWT tokens for arbitrary users including administrators. The signing secret is hardcoded to the literal string 'random' in both the dev.env template and as a Viper default in cmd/serve.go, and publicly available exploit code exists in the advisory. No CISA KEV listing or EPSS data is provided, but the secret is trivially derivable from the public GitHub repository.

Cryptographic message forgery in OpenSSL (branches 3.0.x, 3.4.x, 3.5.x, 3.6.x, and 4.0.0) allows an attacker to craft CMS AuthEnvelopedData messages that pass authentication and are accepted as genuine, defeating the integrity guarantee of CMS authenticated encryption. Any application relying on OpenSSL's CMS layer to reject tampered or forged authenticated-envelope messages can be tricked into processing attacker-controlled content as trusted. There is no public exploit identified at time of analysis, EPSS is 0.00%, and CISA SSVC lists exploitation status as none, but the flaw is network-reachable with no privileges required.

Incorrect authentication tag processing for empty messages in OpenSSL's AES-GCM-SIV and AES-SIV cipher modes enables network-positioned attackers to bypass integrity guarantees on empty ciphertext, yielding limited confidentiality and integrity violations (CVSS 4.8, CWE-325). Affected branches span OpenSSL 3.0.x through 4.0.0, all patched in the OpenSSL 4.0.1 security release dated 2026-06-09. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Null pointer dereference in OpenSSL's password-based CMS decryption path enables remote denial of service against applications that process CMS EnvelopedData with password-based key derivation. The flaw affects a wide range of OpenSSL branches spanning 1.0.2 through 4.0.0, making the exposure surface unusually broad across long-term support and current releases. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS score of 5.9 (Medium) reflects the high attack complexity required to trigger the condition.

Integrity-check bypass in OpenSSL 3.4.x, 3.5.x, 3.6.x, and 4.0.0 allows PKCS#12 files protected with PBMAC1 to be accepted even when secured by dangerously short HMAC keys, undermining the authentication of the keystore contents. Vendor patches are available in 3.4.6, 3.5.7, 3.6.3, and 4.0.1, and no public exploit identified at time of analysis; EPSS is 0.00% and the issue is not on the CISA KEV list.

Denial of service in OpenSSL QUIC implementation allows remote unauthenticated attackers to exhaust server memory by sending crafted PATH_CHALLENGE frames that trigger unbounded memory growth in the QUIC handler. The flaw affects OpenSSL branches 3.4.x, 3.5.x, 3.6.x, and 4.0.0, and is fixed in the 4.0.1 security release alongside numerous other CVEs. No public exploit identified at time of analysis and EPSS is very low (0.02%), but the network-reachable, no-auth nature of QUIC server endpoints makes the issue operationally relevant for TLS/QUIC-facing services.

Heap buffer overflow in OpenSSL's ASN.1 multibyte string conversion routine allows remote attackers to corrupt memory and potentially achieve code execution against applications using affected OpenSSL versions prior to 4.0.1. The flaw was disclosed via the OpenSSL 4.0.1 security patch release alongside 17 other CVEs and is classified as a high-severity issue (CVSS 8.1) with no public exploit identified at time of analysis.

Denial of service in OpenSSL 3.6.0-3.6.2 and 4.0.0 allows remote attackers to crash applications by triggering a NULL pointer dereference during certificate verification when OCSP checking is enabled. The flaw is patched in OpenSSL 4.0.1 (and 3.6.3) per the vendor's 2026-06-09 security advisory; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Denial-of-service in OpenSSL's ASN.1 content parser allows remote unauthenticated attackers to trigger a heap buffer over-read that can crash applications relying on the library for cryptographic parsing. Disclosed via the OpenSSL 4.0.1 security release on 2026-06-09 alongside more than a dozen other fixes, this issue affects every supported branch from 1.0.2 through 3.6 and 4.0. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the broad install base of OpenSSL across servers, clients, and embedded devices makes patching a priority.

Out-of-bounds read in OpenSSL 4.0.0's `X509_VERIFY_PARAM_set1_email()` function can crash applications performing email-based X.509 certificate verification when processing attacker-influenced email input, resulting in a denial-of-service condition. The vulnerability is scoped to OpenSSL 4.0.0 only and was patched in the June 9, 2026 security release (4.0.1), which bundled fixes for 18 CVEs. No public exploit identified at time of analysis and no CISA KEV listing.

Trust anchor substitution in OpenSSL's CMP rootCaKeyUpdate handler allows a network-positioned attacker with low privileges to bypass certificate validation via a cert/issuer field confusion bug (CWE-295), affecting four actively maintained OpenSSL branches. The high confidentiality impact (C:H) reflects the potential for a substituted malicious trust anchor to undermine TLS certificate chains, enabling downstream interception of protected communications. No public exploit identified at time of analysis; vendor patch released 2026-06-09 across all affected branches.

Denial of service in OpenSSL 3.5.x, 3.6.x, and 4.0.0 stems from a NULL pointer dereference triggered during QUIC server initial packet handling, allowing remote unauthenticated attackers to crash affected servers by sending crafted QUIC traffic. The flaw was disclosed via the OpenSSL 4.0.1 security release on 2026-06-09 alongside multiple other CVEs; no public exploit identified at time of analysis and no CISA KEV listing. Patched versions are available from the upstream project and downstream distributions including Ubuntu (USN-8414-1).

FFC-DH peer validation in OpenSSL incorrectly accepts an attacker-supplied `q` (subgroup order) parameter instead of using the locally trusted value, undermining the cryptographic integrity of Diffie-Hellman key exchange. Affected branches span OpenSSL 3.0.x, 3.4.x, 3.5.x, 3.6.x, and 4.0.0, with patched releases issued across all five branches on 2026-06-09. With a CVSS score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) and no confirmed active exploitation or public proof-of-concept, this is a moderate-priority patch item rather than an emergency response trigger - though its broad reach across widely deployed OpenSSL branches warrants timely remediation.

Bleichenbacher oracle in OpenSSL's CMS_decrypt() and PKCS7_decrypt() functions exposes RSA-encrypted message content to unauthenticated remote attackers who can submit adaptive chosen-ciphertext queries against multi-RecipientInfo CMS/PKCS7 structures. Four active OpenSSL branches are affected (3.4.x, 3.5.x, 3.6.x, and 4.0.x), with patches released under the coordinated OpenSSL security advisory on 2026-06-09. No public exploit code and no active exploitation have been identified at time of analysis; SSVC rates this non-automatable with partial technical impact, consistent with the attack's high operational complexity.

Confidentiality break in OpenSSL's AES-OCB implementation stems from the EVP_Cipher() code path ignoring the caller-supplied initialization vector (IV), causing the cipher to operate with a fixed/default IV instead. Affected branches include 3.0.x prior to 3.0.21, 3.4.x prior to 3.4.6, 3.5.x prior to 3.5.7, 3.6.x prior to 3.6.3, and 4.0.0, fixed in OpenSSL 4.0.1 and corresponding maintenance releases. With no public exploit identified at time of analysis and no CISA KEV listing, the issue is rated High (CVSS 7.5) due to high confidentiality impact via network-reachable cryptographic operations.

NULL pointer dereference in OpenSSL's CRMF EncryptedValue decryption path crashes the affected process, creating a remotely triggerable denial-of-service condition across five actively maintained OpenSSL branches (3.0.x, 3.4.x, 3.5.x, 3.6.x, and 4.0.x). The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, score 5.9) confirms network reachability with no authentication required, but high attack complexity limits trivial mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the broad version coverage and OpenSSL's ubiquitous deployment make patching a priority for any infrastructure using certificate management protocols.

Out-of-bounds read in OpenSSL's CMS password-based decryption code (CVE-2026-9076) allows remote attackers to cause denial of service against applications that decrypt attacker-supplied CMS messages. The flaw is fixed in OpenSSL 4.0.1 alongside a batch of other cryptographic vulnerabilities, with no public exploit identified at time of analysis and no CISA KEV listing. Multiple OpenSSL branches (1.0.2, 1.1.1, 3.0, 3.4, 3.5, 3.6, and 4.0.0) require updates per the upstream advisory.

Heap use-after-free in OpenSSL's PKCS7_verify() function affects multiple supported branches (1.0.2, 1.1.1, 3.0.x, 3.4.x, 3.5.x, 3.6.x, and 4.0.0) and is fixed in OpenSSL 4.0.1. Authenticated remote attackers able to submit crafted PKCS#7 signed data to a vulnerable application can trigger memory corruption leading to high-impact compromise of confidentiality, integrity, and availability per CVSS 8.8. No public exploit identified at time of analysis; EPSS is low (0.12%, 30th percentile) and CISA SSVC reports no observed exploitation, though the flaw is rated automatable with total technical impact.

Double-free vulnerability in OpenSSL's OCSP stapled response verification allows remote attackers with low privilege to cause memory corruption affecting confidentiality, integrity, and availability. CVE-2026-35188 affects OpenSSL 4.0.0 (fixed in 4.0.1) and the 3.6.x branch (fixed in 3.6.3), and is one of seventeen CVEs addressed in the OpenSSL 4.0.1 security patch release published 2026-06-09. No public exploit and no active exploitation (CISA KEV) have been identified at time of analysis; however, the SSVC framework rates technical impact as 'total', flagging potential severity beyond the moderate CVSS base score.

Argument injection in the kubectl_generic tool of mcp-server-kubernetes (npm, ≤ 3.6.2) enables Kubernetes bearer token exfiltration through indirect prompt injection, allowing privilege escalation to the operator's full RBAC permissions. An attacker with limited cluster access plants a crafted JSON payload in pod log output; when an AI agent using the MCP server reads those logs and follows the injected instruction, kubectl_generic calls kubectl with attacker-controlled --server and --insecure-skip-tls-verify flags, forwarding the operator's kubeconfig bearer token to an attacker-controlled HTTPS endpoint. A fully working public PoC exists confirmed end-to-end on a live kind cluster using Claude Haiku; the fix is available in version 3.7.0. No active exploitation per CISA KEV is confirmed at time of analysis.

DNS transaction ID entropy collapse in AdGuard Home (≤v0.107.74) and its underlying dnsproxy library (≤v0.81.2) reduces the backend UDP forwarding tuple from two random variables to one: the DNS ID is deterministically 0 on every client-triggered DoQ-to-UDP hop, leaving only the UDP source port as the sole remaining entropy variable. An off-path attacker who can inject spoofed ICMP error messages toward the resolver's egress address can exploit a reliable source-port oracle - confirmed across four consecutive runs for both products - to identify the correct backend socket state before injecting a forged DNS response, placing this attack in the same threat-model class as SAD DNS and TUdoor. No public exploit confirmed at time of analysis beyond the working oracle reproducer included in the advisory disclosure; the advisory is not listed in CISA KEV.

Credential theft and authorization tampering in Cloud Foundry BOSH (versions prior to v282.1.9) stems from the nats-sync component disabling TLS certificate validation when contacting the BOSH director. An attacker positioned on the network between nats-sync and the director can intercept Basic auth headers or UAA client secrets and modify the VM list written into the NATS authorization file, ultimately gaining administrative director access. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Credential theft and UAA token redirection in Cloud Foundry BOSH versions prior to v282.1.9 allows a network-positioned local attacker to intercept Basic-auth secrets and OAuth requests flowing between bosh-monitor and the BOSH director or UAA. The flaw stems from hard-coded OpenSSL::SSL::VERIFY_NONE in the HttpRequestHelper, effectively disabling TLS certificate validation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Tychon includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory that may be controllable by an unprivileged user on Windows. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required.

Missing CSRF protection on the PKCS#12 private key export endpoint in Admidio v5.0.9 allows a network-based attacker to force an authenticated administrator's browser to trigger an unauthorized SSO private key export. The SecurityUtils::validateCsrfToken() call in modules/sso/keys.php was commented out on the 'export' case, permitting forged cross-site POST requests to invoke KeyService::exportToPkcs12() without a valid form token. While same-origin policy prevents the attacker from reading the streamed .p12 response directly, a working proof-of-concept is publicly documented in the GitHub security advisory and a vendor-confirmed fix is available in version 5.0.10.

Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbitrary code via unspecified vectors. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Insecure PRNG fallback in Crypt::ScryptKDF for Perl (versions through 0.010) exposes applications to cryptographically weak random byte generation when none of five recognized CSPRNG modules are installed. The `random_bytes` function silently degrades to Perl's built-in `rand()`, which is not a cryptographically secure source, potentially weakening scrypt-derived salts or keys in password hashing and key derivation workflows. No public exploit is identified and EPSS is 0.02% (4th percentile), but the cryptographic impact in minimally-configured Perl environments could be severe, as predictable salts dramatically reduce the cost of offline attacks against derived key material.