Openssl

This hub aggregates every CVE we track for Openssl, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Openssl.

• CVE-2026-75803AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()9.1Aug 25, 2026
• CVE-2026-63076Invalid Pointer Dereference in CMP Server via Crafted protectionAlg7.5Aug 25, 2026
• CVE-2026-63075QUIC ACK-only Packet Retention Can Cause Memory Exhaustion7.5Aug 25, 2026
• CVE-2026-63074CMP Indefinite Cache Growth of ExtraCerts5.9Aug 25, 2026
• CVE-2026-63073Untrusted Sender DN Used as Format String in CMP Response Validation9.8Aug 25, 2026
• CVE-2026-63072Heap Buffer Overflow in CMS Key Unwrapping7.5Aug 25, 2026
• CVE-2026-54874Excessive Memory Use Buffering DTLS Records for a Future Epoch7.5Aug 25, 2026
• CVE-2026-18798QUIC Server May Trigger Double Free When Processing INITIAL Packet7.5Aug 25, 2026
• CVE-2026-14457RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate7.5Aug 25, 2026
• CVE-2026-14456Unbounded Memory Growth in QUIC Server Incoming Channel Queue7.5Aug 13, 2026
• CVE-2026-54876Client-Side Memory Leak in OCSP Response Checking7.5Aug 5, 2026
• CVE-2026-45784rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers7.1Jul 17, 2026
• CVE-2026-45447Heap Use-After-Free in the PKCS7_verify() Function8.8Jun 9, 2026
• CVE-2026-45446Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes4.8Jun 9, 2026
• CVE-2026-45445AES-OCB IV Ignored on EVP_Cipher() Path7.5Jun 9, 2026