- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
openssl command-line program, the libcrypto cryptographic library, and the libssl library for SSL/TLS communications, supporting developers and organizations that build secure networked applications and manage certificates and keys.As of 11/04/2026, OpenSSL recorded 24 security vulnerabilities in the last 90 days across 1 products, including 14 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, OpenSSL had the most security vulnerabilities in the OpenSSL ecosystem, with 24 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2022-3358Using a Custom Cipher with NID_undef may lead to NULL encryptionCVE-2022-2097AES OCB fails to encrypt some bytesCVE-2022-2274RSA implementation bug in AVX512IFMA instructionsCVE-2022-2068The c_rehash script allows command injectionCVE-2022-1473Resource leakage when decoding certificates and keys| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2022-3358Using a Custom Cipher with NID_undef may lead to NULL encryption | Exploitation statusNot confirmed | FixYes |
| Published10/11/2022 |
| SeverityUnknown |
CVE-2022-2097AES OCB fails to encrypt some bytes | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published07/05/2022 | SeverityUnknown |
|---|
CVE-2022-2274RSA implementation bug in AVX512IFMA instructions | Exploitation statusNot confirmed | FixNo | Affected productOpenSSL | Published07/01/2022 | SeverityUnknown |
|---|
CVE-2022-2068The c_rehash script allows command injection | Exploitation statusActively exploited | FixYes | Affected productOpenSSL | Published06/21/2022 | SeverityCritical |
|---|
CVE-2022-1473Resource leakage when decoding certificates and keys | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published05/03/2022 | SeverityHigh |
|---|
CVE-2022-1434Incorrect MAC key used in the RC4-MD5 ciphersuite | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published05/03/2022 | SeverityUnknown |
|---|
CVE-2022-1343OCSP_basic_verify may incorrectly verify the response signing certificate | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published05/03/2022 | SeverityMedium |
|---|
CVE-2022-1292The c_rehash script allows command injection | Exploitation statusActively exploited | FixYes | Affected productOpenSSL | Published05/03/2022 | SeverityCritical |
|---|
CVE-2022-0778Infinite loop in BN_mod_sqrt() reachable when parsing certificates | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published03/15/2022 | SeverityHigh |
|---|
CVE-2021-4160BN_mod_exp may produce incorrect results on MIPS | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published01/28/2022 | SeverityUnknown |
|---|
CVE-2021-4044Invalid handling of X509_verify_cert() internal errors in libssl | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published12/14/2021 | SeverityUnknown |
|---|
CVE-2021-3712Read buffer overruns processing ASN.1 strings | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published08/24/2021 | SeverityHigh |
|---|
CVE-2021-3711SM2 Decryption Buffer Overflow | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published08/24/2021 | SeverityUnknown |
|---|
CVE-2021-3450CA certificate check bypass with X509_V_FLAG_X509_STRICT | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published03/25/2021 | SeverityUnknown |
|---|
CVE-2021-3449NULL pointer deref in signature_algorithms processing | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published03/25/2021 | SeverityUnknown |
|---|
CVE-2021-23841Null pointer deref in X509_issuer_and_serial_hash() | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published02/16/2021 | SeverityUnknown |
|---|
CVE-2021-23840Integer overflow in CipherUpdate | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published02/16/2021 | SeverityHigh |
|---|
CVE-2021-23839Incorrect SSLv2 rollback protection | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published02/16/2021 | SeverityUnknown |
|---|
CVE-2020-1971EDIPARTYNAME NULL pointer dereference | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published12/08/2020 | SeverityMedium |
|---|
CVE-2020-1968Raccoon attack | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published09/09/2020 | SeverityLow |
|---|
CVE-2020-1967Segmentation fault in SSL_check_chain | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published04/21/2020 | SeverityUnknown |
|---|
CVE-2019-1551rsaz_512_sqr overflow bug on x86_64 | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published12/06/2019 | SeverityUnknown |
|---|
CVE-2011-4121CVE-2011-4121 | Exploitation statusNot confirmed | FixNo | Affected productOpenSSL extension of Ruby (Git trunk) | Published11/26/2019 | SeverityUnknown |
|---|
CVE-2019-1563Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published09/10/2019 | SeverityUnknown |
|---|
CVE-2019-1549Fork Protection | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published09/10/2019 | SeverityUnknown |
|---|
CVE-2019-1547ECDSA remote timing attack | Exploitation statusNot exploited | FixYes | Affected productOpenSSL | Published09/10/2019 | SeverityUnknown |
|---|
CVE-2019-1552Windows builds with insecure path defaults | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published07/30/2019 | SeverityUnknown |
|---|
CVE-2019-1543ChaCha20-Poly1305 with long nonces | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published03/06/2019 | SeverityUnknown |
|---|
CVE-2019-15590-byte record padding oracle | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published02/27/2019 | SeverityUnknown |
|---|
CVE-2018-0734Timing attack against DSA | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published10/30/2018 | SeverityUnknown |
|---|
CVE-2018-0735Timing attack against ECDSA signature generation | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published10/29/2018 | SeverityUnknown |
|---|
CVE-2018-0732Client DoS due to large DH parameter | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published06/12/2018 | SeverityUnknown |
|---|
CVE-2018-0737Cache timing vulnerability in RSA Key Generation | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published04/16/2018 | SeverityUnknown |
|---|
CVE-2018-0739Constructed ASN.1 types with a recursive definition could exceed the stack | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published03/27/2018 | SeverityUnknown |
|---|
CVE-2018-0733Incorrect CRYPTO_memcmp on HP-UX PA-RISC | Exploitation statusNot confirmed | FixYes | Affected productOpenSSL | Published03/27/2018 | SeverityUnknown |
|---|
CVE-2016-8610CVE-2016-8610 | Exploitation statusNot confirmed | FixNo | Affected productOpenSSL | Published11/13/2017 | SeverityUnknown |
|---|
CVE-2017-3733Encrypt-Then-Mac renegotiation crash | Exploitation statusNot confirmed | FixNo | Affected productOpenSSL | Published05/04/2017 | SeverityUnknown |
|---|
CVE-2017-3732BN_mod_exp may produce incorrect results on x86_64 | Exploitation statusNot confirmed | FixNo | Affected productOpenSSL | Published05/04/2017 | SeverityUnknown |
|---|
CVE-2017-3731Truncated packet could crash via OOB read | Exploitation statusNot confirmed | FixNo | Affected productOpenSSL | Published05/04/2017 | SeverityUnknown |
|---|
CVE-2017-3730Bad (EC)DHE parameters cause a client crash | Exploitation statusActively exploited | FixNo | Affected productOpenSSL | Published05/04/2017 | SeverityUnknown |
|---|
CVE-2016-7054ChaCha20/Poly1305 heap-buffer-overflow | Exploitation statusActively exploited | FixNo | Affected productOpenSSL | Published05/04/2017 | SeverityUnknown |
|---|
CVE-2016-7053CMS Null dereference | Exploitation statusNot confirmed | FixNo | Affected productOpenSSL | Published05/04/2017 | SeverityUnknown |
|---|
142 Results | Page 3 of 3