OpenSSL

Products

Exploited and recent CVEs

• CVE-2026-84784 High 7.5 QUIC: Unbounded RETIRE_CONNECTION_ID Backlog 0.6%
• CVE-2026-84783 High 7.5 Use-After-Free in X.509 Extension Cache Under Concurrent Use 0.3%
• CVE-2026-84782 High 8.2 DTLS Retransmits Handshake Messages From a Stale Buffer Offset 0.8%
• CVE-2026-77696 Low 3.7 Timing Side-Channel in SM2 Signature Generation 0.4%
• CVE-2026-75806 Medium 5.3 Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS 1.1%
• CVE-2026-75805 Medium 5.3 NULL Pointer Dereference in CMP Client Revocation Response Handling 0.3%
• CVE-2026-75804 Medium 5.3 QUIC Connection-Level Flow Control is Not Enforced for Streams 0.5%
• CVE-2026-72897 High 7.5 Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake 0.4%
• CVE-2026-54875 Low 3.7 Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V 0.5%
• CVE-2026-54873 High 7.5 QUIC STREAM Fragment Metadata DoS 0.7%
• CVE-2026-54872 Low 3.7 Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves 0.4%
• CVE-2026-42772 Medium 5.3 Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC 0.5%
• CVE-2026-35191 Low 3.7 QUIC Unvalidated Amplification Credit may be Over Accounted 0.7%
• CVE-2026-35189 Medium 5.3 Excessive Memory Allocation in Relative CRLDP Processing 0.3%
• CVE-2026-75803 Critical 9.1 AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher() 0.3%
• CVE-2026-63076 High 7.5 Invalid Pointer Dereference in CMP Server via Crafted protectionAlg 1.6%
• CVE-2026-63075 High 7.5 QUIC ACK-only Packet Retention Can Cause Memory Exhaustion 0.6%
• CVE-2026-63074 Medium 5.9 CMP Indefinite Cache Growth of ExtraCerts 0.6%
• CVE-2026-63073 Critical 9.8 Untrusted Sender DN Used as Format String in CMP Response Validation 1.2%
• CVE-2026-63072 High 7.5 Heap Buffer Overflow in CMS Key Unwrapping 0.9%
• CVE-2026-54874 High 7.5 Excessive Memory Use Buffering DTLS Records for a Future Epoch 0.6%
• CVE-2026-18798 High 7.5 QUIC Server May Trigger Double Free When Processing INITIAL Packet 1.7%
• CVE-2026-14457 High 7.5 RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate 1.2%
• CVE-2026-14456 High 7.5 Unbounded Memory Growth in QUIC Server Incoming Channel Queue 0.7%
• CVE-2026-54876 High 7.5 Client-Side Memory Leak in OCSP Response Checking 0.5%
• CVE-2026-45447 High 8.8 Heap Use-After-Free in the PKCS7_verify() Function 4.0%
• CVE-2026-45446 Medium 4.8 Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes 0.4%
• CVE-2026-45445 High 7.5 AES-OCB IV Ignored on EVP_Cipher() Path 0.7%
• CVE-2026-42771 Medium 6.2 Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email() 0.2%
• CVE-2026-42770 Low 3.7 FFC-DH Peer Validation Uses Attacker-Supplied q 0.5%