OpenSSL / OpenSSL
297 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-84784 | QUIC: Unbounded RETIRE_CONNECTION_ID Backlog | HIGH | 7.5 | Sep 29, 2026 |
| CVE-2026-84783 | Use-After-Free in X.509 Extension Cache Under Concurrent Use | HIGH | 7.5 | Sep 29, 2026 |
| CVE-2026-84782 | DTLS Retransmits Handshake Messages From a Stale Buffer Offset | HIGH | 8.2 | Sep 29, 2026 |
| CVE-2026-77696 | Timing Side-Channel in SM2 Signature Generation | MEDIUM | 5.9 | Sep 29, 2026 |
| CVE-2026-75806 | Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS | MEDIUM | 5.3 | Sep 29, 2026 |
| CVE-2026-75805 | NULL Pointer Dereference in CMP Client Revocation Response Handling | MEDIUM | 5.9 | Sep 29, 2026 |
| CVE-2026-75804 | QUIC Connection-Level Flow Control is Not Enforced for Streams | HIGH | 7.5 | Sep 29, 2026 |
| CVE-2026-72897 | Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake | HIGH | 7.5 | Sep 29, 2026 |
| CVE-2026-54875 | Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V | MEDIUM | 4.7 | Sep 29, 2026 |
| CVE-2026-54873 | QUIC STREAM Fragment Metadata DoS | HIGH | 7.5 | Sep 29, 2026 |
| CVE-2026-54872 | Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves | MEDIUM | 5.9 | Sep 29, 2026 |
| CVE-2026-42772 | Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC | MEDIUM | 5.3 | Sep 29, 2026 |
| CVE-2026-35191 | QUIC Unvalidated Amplification Credit may be Over Accounted | LOW | 3.7 | Sep 29, 2026 |
| CVE-2026-35189 | Excessive Memory Allocation in Relative CRLDP Processing | MEDIUM | 5.3 | Sep 29, 2026 |
| CVE-2026-75803 | AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher() | CRITICAL | 9.1 | Aug 25, 2026 |
| CVE-2026-63076 | Invalid Pointer Dereference in CMP Server via Crafted protectionAlg | HIGH | 7.5 | Aug 25, 2026 |
| CVE-2026-63075 | QUIC ACK-only Packet Retention Can Cause Memory Exhaustion | HIGH | 7.5 | Aug 25, 2026 |
| CVE-2026-63074 | CMP Indefinite Cache Growth of ExtraCerts | HIGH | 7.5 | Aug 25, 2026 |
| CVE-2026-63073 | Untrusted Sender DN Used as Format String in CMP Response Validation | CRITICAL | 9.8 | Aug 25, 2026 |
| CVE-2026-63072 | Heap Buffer Overflow in CMS Key Unwrapping | HIGH | 7.5 | Aug 25, 2026 |
| CVE-2026-54874 | Excessive Memory Use Buffering DTLS Records for a Future Epoch | HIGH | 7.5 | Aug 25, 2026 |
| CVE-2026-18798 | QUIC Server May Trigger Double Free When Processing INITIAL Packet | HIGH | 7.5 | Aug 25, 2026 |
| CVE-2026-14457 | RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate | HIGH | 7.5 | Aug 25, 2026 |
| CVE-2026-14456 | Unbounded Memory Growth in QUIC Server Incoming Channel Queue | HIGH | 7.5 | Aug 13, 2026 |
| CVE-2026-54876 | Client-Side Memory Leak in OCSP Response Checking | HIGH | 7.5 | Aug 5, 2026 |
Showing 1 to 25 of 297 CVEs