Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2024-5535: Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols

65
This week
CRITICAL 9.1REMOTEWATCHLIST

CVE-2024-5535 is a critical-severity flaw (CVSS 9.1) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of c

Why this priority

  • Critical severity
  • EPSS top 7%: very likely to be exploited
  • Remotely exploitable, no login, no user action
  • On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score9.1 (Critical)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance5.6% (top 7%)
CISA exploited listNo
WeaknessCWE-125
Published2024-06-27
Last modified2026-10-15
Publisher (CNA): OpenSSL Software Foundation

Share: LinkedIn · X · Reddit

Last updated 2026-10-15 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Timeline

Exact fixes by distribution

Fedora 46 · noctalia · FIXED · 5.4.1-1.fc46 · FEDORA-2026-a4755e8ef7 · source
sudo dnf upgrade --advisory=FEDORA-2026-a4755e8ef7
Fedora ELN · efifs · FIXED · 1.13-1.eln159 · FEDORA-2026-3fd0bb7307 · source
sudo dnf upgrade --advisory=FEDORA-2026-3fd0bb7307
Ubuntu 20.04 · openssl · FIXED · 1.1.1f-1ubuntu2.23
sudo apt update && sudo apt install --only-upgrade openssl dpkg --compare-versions "$(dpkg-query -W -f='${Version}' openssl)" ge "1.1.1f-1ubuntu2.23" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 22.04 · openssl · FIXED · 3.0.2-0ubuntu1.17
sudo apt update && sudo apt install --only-upgrade openssl dpkg --compare-versions "$(dpkg-query -W -f='${Version}' openssl)" ge "3.0.2-0ubuntu1.17" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 24.04 · openssl · FIXED · 3.0.13-0ubuntu3.2
sudo apt update && sudo apt install --only-upgrade openssl dpkg --compare-versions "$(dpkg-query -W -f='${Version}' openssl)" ge "3.0.13-0ubuntu3.2" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 24.10 · openssl · FIXED · 3.2.2-1ubuntu2
sudo apt update && sudo apt install --only-upgrade openssl dpkg --compare-versions "$(dpkg-query -W -f='${Version}' openssl)" ge "3.2.2-1ubuntu2" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 25.04 · openssl · FIXED · 3.2.2-1ubuntu2
sudo apt update && sudo apt install --only-upgrade openssl dpkg --compare-versions "$(dpkg-query -W -f='${Version}' openssl)" ge "3.2.2-1ubuntu2" && echo PATCHED || echo STILL-VULNERABLE
Debian 12 · openssl · FIXED · 3.0.15-1~deb12u1
sudo apt update && sudo apt install --only-upgrade openssl dpkg --compare-versions "$(dpkg-query -W -f='${Version}' openssl)" ge "3.0.15-1~deb12u1" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · openssl · FIXED · 3.3.2-1
sudo apt update && sudo apt install --only-upgrade openssl dpkg --compare-versions "$(dpkg-query -W -f='${Version}' openssl)" ge "3.3.2-1" && echo PATCHED || echo STILL-VULNERABLE
RHEL 6 Extended Lifecycle Support - EXTENSION · openssl · FIXED · openssl-1.0.1e-61.el6_10.1
sudo dnf upgrade --advisory=RHSA-2026:66524 rpm -q openssl
RHEL 7 Extended Lifecycle Support · openssl · FIXED · openssl-1.0.2k-26.el7_9.2
sudo dnf upgrade --advisory=RHSA-2026:58563 rpm -q openssl
RHEL 8 · mingw-openssl · FIXED · mingw-openssl-1.0.2k-4.el8_10
sudo dnf upgrade --advisory=RHSA-2026:60329 rpm -q mingw-openssl
RHEL 8 · openssl · FIXED · openssl-1.1.1k-14.el8_6
sudo dnf upgrade --advisory=RHSA-2024:7848 rpm -q openssl
RHEL 8.6 Advanced Mission Critical Update Support · openssl · FIXED · openssl-1.1.1k-14.el8_6
sudo dnf upgrade --advisory=RHSA-2024:7846 rpm -q openssl
Alpine 3.20 · openssl · FIXED · openssl-3.3.1-r1
apk add --upgrade openssl apk info -v openssl
Alpine 3.21 · openssl · FIXED · openssl-3.3.1-r1
apk add --upgrade openssl apk info -v openssl
Alpine 3.22 · openssl · FIXED · openssl-3.3.1-r1
apk add --upgrade openssl apk info -v openssl
Alpine 3.23 · openssl · FIXED · openssl-3.3.1-r1
apk add --upgrade openssl apk info -v openssl
Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2024-677 · source
sudo dnf update --advisory=ALAS2023-2024-677
Amazon Linux 2 · see advisory · FIXED · ALAS2-2024-2621 · source
sudo yum update --advisory=ALAS2-2024-2621

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2024-5535?

No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.

Is CVE-2024-5535 being exploited?

CVE-2024-5535 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2024-5535 affect?

CVE-2024-5535 affects affected software. Severity is critical (CVSS 9.1). Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potent

How urgent is CVE-2024-5535?

Priority 65/100. Critical severity; EPSS top 7%: very likely to be exploited; Remotely exploitable, no login, no user action; On your watchlist

Software pages

OpenSSL vulnerabilities

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.