PatchTheCVECVEs published by OpenSSL Software Foundation
CVEs published by OpenSSL Software Foundation (CVE Numbering Authority). 24 tracked.
- CVE-2026-84784 HIGH 7.5 UPGRADE Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoidin
- CVE-2026-84783 HIGH 7.5 UPGRADE Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached
- CVE-2026-84782 HIGH 8.2 UPGRADE Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspe
- CVE-2026-77696 LOW 3.7 UPGRADE Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing s
- CVE-2026-75806 MEDIUM 5.3 UPGRADE Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single un
- CVE-2026-75805 MEDIUM 5.3 UPGRADE Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference
- CVE-2026-75804 MEDIUM 5.3 UPGRADE Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams
- CVE-2026-72897 HIGH 7.5 UPGRADE Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part wa
- CVE-2026-54875 LOW 3.7 UPGRADE Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 pri
- CVE-2026-54873 HIGH 7.5 UPGRADE Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Imp
- CVE-2026-54872 LOW 3.7 UPGRADE Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations wi
- CVE-2026-42772 MEDIUM 5.3 UPGRADE Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arri
- CVE-2026-35191 LOW 3.7 UPGRADE Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to co
- CVE-2026-35189 MEDIUM 5.3 UPGRADE Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate
- CVE-2026-18798 HIGH 7.5 UPGRADE Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for i
- CVE-2026-75803 CRITICAL 9.1 UPGRADE Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without ve
- CVE-2026-63076 HIGH 7.5 UPGRADE Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parame
- CVE-2026-63075 HIGH 7.5 UPGRADE Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets whi
- CVE-2026-63074 MEDIUM 5.9 UPGRADE Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) s
- CVE-2026-63073 CRITICAL 9.8 UPGRADE Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directl
- CVE-2026-63072 HIGH 7.5 UPGRADE Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key s
- CVE-2026-54874 HIGH 7.5 UPGRADE Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to b
- CVE-2026-14457 HIGH 7.5 UPGRADE Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the p
- CVE-2026-14456 HIGH 7.5 Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unkn