- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
openssl command-line program, the libcrypto cryptographic library, and the libssl library for SSL/TLS communications, supporting developers and organizations that build secure networked applications and manage certificates and keys.As of 11/04/2026, OpenSSL recorded 24 security vulnerabilities in the last 90 days across 1 products, including 14 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, OpenSSL had the most security vulnerabilities in the OpenSSL ecosystem, with 24 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-84784QUIC: Unbounded RETIRE_CONNECTION_ID BacklogCVE-2026-84783Use-After-Free in X.509 Extension Cache Under Concurrent UseCVE-2026-84782DTLS Retransmits Handshake Messages From a Stale Buffer OffsetCVE-2026-77696Timing Side-Channel in SM2 Signature GenerationCVE-2026-75806Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-84784QUIC: Unbounded RETIRE_CONNECTION_ID Backlog | Exploitation statusNot exploited | FixYes |
| Published09/29/2026 |
| SeverityHigh |
CVE-2026-84783Use-After-Free in X.509 Extension Cache Under Concurrent Use | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published09/29/2026 | SeverityHigh |
|---|
CVE-2026-84782DTLS Retransmits Handshake Messages From a Stale Buffer Offset | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published09/29/2026 | SeverityHigh |
|---|
CVE-2026-77696Timing Side-Channel in SM2 Signature Generation | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published09/29/2026 | SeverityLow |
|---|
CVE-2026-75806Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published09/29/2026 | SeverityMedium |
|---|
CVE-2026-75805NULL Pointer Dereference in CMP Client Revocation Response Handling | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published09/29/2026 | SeverityMedium |
|---|
CVE-2026-75804QUIC Connection-Level Flow Control is Not Enforced for Streams | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published09/29/2026 | SeverityMedium |
|---|
CVE-2026-72897Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published09/29/2026 | SeverityHigh |
|---|
CVE-2026-54875Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published09/29/2026 | SeverityLow |
|---|
CVE-2026-54873QUIC STREAM Fragment Metadata DoS | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published09/29/2026 | SeverityHigh |
|---|
CVE-2026-54872Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published09/29/2026 | SeverityLow |
|---|
CVE-2026-42772Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published09/29/2026 | SeverityMedium |
|---|
CVE-2026-35191QUIC Unvalidated Amplification Credit may be Over Accounted | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published09/29/2026 | SeverityLow |
|---|
CVE-2026-35189Excessive Memory Allocation in Relative CRLDP Processing | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published09/29/2026 | SeverityMedium |
|---|
CVE-2026-75803AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher() | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published08/25/2026 | SeverityCritical |
|---|
CVE-2026-63076Invalid Pointer Dereference in CMP Server via Crafted protectionAlg | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published08/25/2026 | SeverityHigh |
|---|
CVE-2026-63075QUIC ACK-only Packet Retention Can Cause Memory Exhaustion | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published08/25/2026 | SeverityHigh |
|---|
CVE-2026-63074CMP Indefinite Cache Growth of ExtraCerts | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-63073Untrusted Sender DN Used as Format String in CMP Response Validation | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published08/25/2026 | SeverityCritical |
|---|
CVE-2026-63072Heap Buffer Overflow in CMS Key Unwrapping | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published08/25/2026 | SeverityHigh |
|---|
CVE-2026-54874Excessive Memory Use Buffering DTLS Records for a Future Epoch | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published08/25/2026 | SeverityHigh |
|---|
CVE-2026-18798QUIC Server May Trigger Double Free When Processing INITIAL Packet | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published08/25/2026 | SeverityHigh |
|---|
CVE-2026-14457RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published08/25/2026 | SeverityHigh |
|---|
CVE-2026-14456Unbounded Memory Growth in QUIC Server Incoming Channel Queue | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published08/13/2026 | SeverityHigh |
|---|
CVE-2026-54876Client-Side Memory Leak in OCSP Response Checking | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published08/05/2026 | SeverityHigh |
|---|
CVE-2026-9076Out-of-Bounds Read in CMS Password-Based Decryption | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityHigh |
|---|
CVE-2026-7383Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityHigh |
|---|
CVE-2026-45447Heap Use-After-Free in the PKCS7_verify() Function | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityHigh |
|---|
CVE-2026-45446Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityMedium |
|---|
CVE-2026-45445AES-OCB IV Ignored on EVP_Cipher() Path | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityHigh |
|---|
CVE-2026-42771Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email() | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityMedium |
|---|
CVE-2026-42770FFC-DH Peer Validation Uses Attacker-Supplied q | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityLow |
|---|
CVE-2026-42769Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityMedium |
|---|
CVE-2026-42768Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityLow |
|---|
CVE-2026-42767NULL Pointer Dereference in CRMF EncryptedValue Decryption | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityMedium |
|---|
CVE-2026-42766Possible NULL Dereference in Password-Based CMS Decryption | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityMedium |
|---|
CVE-2026-42765NULL Dereference in Certificate Verification with OCSP Checking | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityHigh |
|---|
CVE-2026-42764NULL Pointer Dereference in QUIC Server Initial Packet Handling | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityHigh |
|---|
CVE-2026-35188Double-free When Checking OCSP Stapled Response | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityMedium |
|---|
CVE-2026-34183Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityHigh |
|---|
CVE-2026-34182CMS AuthEnvelopedData Processing May Accept Forged Messages | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityCritical |
|---|
CVE-2026-34181PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityHigh |
|---|
CVE-2026-34180Heap Buffer Over-read in ASN.1 Content Parsing | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published06/09/2026 | SeverityHigh |
|---|
CVE-2026-31790Incorrect Failure Handling in RSA KEM RSASVE Encapsulation | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published04/07/2026 | SeverityHigh |
|---|
CVE-2026-31789Heap Buffer Overflow in Hexadecimal Conversion | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published04/07/2026 | SeverityMedium |
|---|
CVE-2026-28390Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published04/07/2026 | SeverityHigh |
|---|
CVE-2026-28389Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published04/07/2026 | SeverityHigh |
|---|
CVE-2026-28388NULL Pointer Dereference When Processing a Delta CRL | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published04/07/2026 | SeverityHigh |
|---|
CVE-2026-28387Potential Use-after-free in DANE Client Code | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published04/07/2026 | SeverityHigh |
|---|
CVE-2026-28386Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published04/07/2026 | SeverityCritical |
|---|
142 Results | Page 1 of 3