What’s Vulnerable › Products

OpenSSL vulnerabilities

322 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 70 published in the last 12 months.

Check whether your OpenSSL version is affected

Exploited OpenSSL vulnerabilities

• CVE-2014-0160 — OpenSSL Information Disclosure Vulnerability

Latest OpenSSL vulnerabilities

• CVE-2026-84784 — QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (CVSS 7.5)
• CVE-2026-84783 — Use-After-Free in X.509 Extension Cache Under Concurrent Use (CVSS 7.5)
• CVE-2026-84782 — DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVSS 8.2)
• CVE-2026-77696 — Timing Side-Channel in SM2 Signature Generation (CVSS 3.7)
• CVE-2026-75806 — Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (CVSS 5.3)
• CVE-2026-75805 — NULL Pointer Dereference in CMP Client Revocation Response Handling (CVSS 5.3)
• CVE-2026-75804 — QUIC Connection-Level Flow Control is Not Enforced for Streams (CVSS 5.3)
• CVE-2026-72897 — Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (CVSS 7.5)
• CVE-2026-54875 — Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (CVSS 3.7)
• CVE-2026-54873 — QUIC STREAM Fragment Metadata DoS (CVSS 7.5)
• CVE-2026-54872 — Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (CVSS 3.7)
• CVE-2026-42772 — Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC (CVSS 5.3)
• CVE-2026-35191 — QUIC Unvalidated Amplification Credit may be Over Accounted (CVSS 3.7)
• CVE-2026-35189 — Excessive Memory Allocation in Relative CRLDP Processing (CVSS 5.3)
• CVE-2026-75803 — AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher() (CVSS 9.1)
• CVE-2026-63076 — Invalid Pointer Dereference in CMP Server via Crafted protectionAlg (CVSS 7.5)
• CVE-2026-63075 — QUIC ACK-only Packet Retention Can Cause Memory Exhaustion (CVSS 7.5)
• CVE-2026-63074 — CMP Indefinite Cache Growth of ExtraCerts (CVSS 5.9)
• CVE-2026-63073 — Untrusted Sender DN Used as Format String in CMP Response Validation (CVSS 9.8)
• CVE-2026-63072 — Heap Buffer Overflow in CMS Key Unwrapping (CVSS 7.5)
• CVE-2026-54874 — Excessive Memory Use Buffering DTLS Records for a Future Epoch (CVSS 7.5)
• CVE-2026-18798 — QUIC Server May Trigger Double Free When Processing INITIAL Packet (CVSS 7.5)
• CVE-2026-14457 — RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate (CVSS 7.5)
• CVE-2026-14456 — Unbounded Memory Growth in QUIC Server Incoming Channel Queue (CVSS 7.5)
• CVE-2026-54876 — Client-Side Memory Leak in OCSP Response Checking (CVSS 7.5)