OpenSSL vulnerabilities

CVEs per yearBy the year they were published

1. 20174
2. 20173
3. 20186
4. 20197
5. 20191
6. 20203
7. 20219
8. 202315
9. 202418
10. 20259
11. 202653
12. 202614

Newest CVEs

• CVE-2026-84784

  QUIC: Unbounded RETIRE_CONNECTION_ID Backlog

  OpenSSL · OpenSSL

  High7.5
• CVE-2026-84783

  Use-After-Free in X.509 Extension Cache Under Concurrent Use

  OpenSSL · OpenSSL

  High7.5
• CVE-2026-84782

  DTLS Retransmits Handshake Messages From a Stale Buffer Offset

  OpenSSL · OpenSSL

  High8.2
• CVE-2026-77696

  Timing Side-Channel in SM2 Signature Generation

  OpenSSL · OpenSSL

  Low3.7
• CVE-2026-75806

  Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS

  OpenSSL · OpenSSL

  Medium5.3
• CVE-2026-75805

  NULL Pointer Dereference in CMP Client Revocation Response Handling

  OpenSSL · OpenSSL

  Medium5.3
• CVE-2026-75804

  QUIC Connection-Level Flow Control is Not Enforced for Streams

  OpenSSL · OpenSSL

  Medium5.3
• CVE-2026-72897

  Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake

  OpenSSL · OpenSSL

  High7.5
• CVE-2026-54875

  Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V

  OpenSSL · OpenSSL

  Low3.7
• CVE-2026-54873

  QUIC STREAM Fragment Metadata DoS

  OpenSSL · OpenSSL

  High7.5