Loading story…
OpenSSL released fixes for five vulnerabilities across supported branches: CVE-2015-3193, an x86_64 BN_mod_exp Montgomery-squaring carry-propagation flaw that can yield incorrect cryptographic results and could aid private-key recovery in Diffie-Hellman/DHE use; CVE-2015-3194, a malformed RSA-PSS certificate-parameter crash; and CVE-2015-3195, an X509_ATTRIBUTE memory leak in PKCS#7 and CMS processing. The advisory also addressed CVE-2015-3196, a PSK identity-hint race condition, and CVE-2015-1794, an anonymous-DH ServerKeyExchange denial-of-service issue.
Organizations were advised to upgrade to OpenSSL 1.0.2e, 1.0.1q, 1.0.0t, or 0.9.8zh as applicable. CVE-2015-3193 affects versions before 1.0.2e on x86_64 systems and is most relevant where DH or DHE cipher suites are enabled; exploitation was considered high complexity. OpenSSL also announced that 1.0.0t and 0.9.8zh would be the final releases for their branches as support for OpenSSL 1.0.0 and 0.9.8 ended.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
OpenSSL publicly disclosed CVE-2015-3193, CVE-2015-3194, CVE-2015-3195, CVE-2015-3196, and CVE-2015-1794, and recommended upgrades including 1.0.2e and 1.0.1q. The advisory noted that CVE-2015-3196, a PSK identity-hint race condition that can lead to double free, had already been fixed in 1.0.2d and 1.0.1p but had not previously appeared in an advisory.
Adam Langley of Google/BoringSSL reported CVE-2015-3195 using libFuzzer. A malformed X509_ATTRIBUTE structure can cause a memory leak when processing PKCS#7 or CMS data from untrusted sources.
Loïc Jonas Etienne of Qnective AG reported CVE-2015-3194 to OpenSSL. An ASN.1 RSA-PSS signature lacking a mask-generation-function parameter can trigger a NULL-pointer dereference during certificate verification.
Hanno Böck reported CVE-2015-3193 to OpenSSL. Incorrect carry propagation in the x86_64 Montgomery squaring procedure can cause BN_mod_exp to produce incorrect results.
Guy Leaver of Cisco reported CVE-2015-1794 to OpenSSL. The flaw allows an anonymous DH ServerKeyExchange with a p value of 0 to cause a client segmentation fault and possible denial of service.
OpenSSL updated its December 3 security advisory to add details of CVE-2015-1794. The anonymous-DH handling flaw had already been fixed in released packages but was omitted from the original advisory text.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenSSL disclosed a broad set of vulnerabilities affecting ASN.1 parsing, PKCS#12, CMS/PKCS#7, QUIC, OCSP, CMP/CRMF, DH key validation, AEAD cipher handling, and certificate and email validation across the 4.0, 3.6, 3.5, 3.4, and 3.0 branches. The most severe issue, **CVE-2026-45447**, is a high-severity heap use-after-free in `PKCS7_verify()` that can be triggered by specially crafted PKCS#7 or S/MIME signed messages and could lead to crashes, heap corruption, or potentially remote code execution. The advisory also details moderate-severity flaws that could enable forged CMS `AuthEnvelopedData` messages, denial-of-service conditions in QUIC and OCSP processing, a TLS client double-free via OCSP stapling, a QUIC server `NULL` dereference, and cryptographic failures in AES-OCB when applications use the `EVP_Cipher()` one-shot API, alongside numerous lower-severity parsing, validation, and bounds-checking bugs. OpenSSL said most issues were fixed in **4.0.1**, **3.6.3**, **3.5.7**, **3.4.6**, and **3.0.21**, with **1.1.1zh** and **1.0.2zq** issued for supported legacy customers; most flaws were reported as outside the OpenSSL FIPS module boundary, except **CVE-2026-42770**, which affects FIPS modules in multiple supported branches.
Jun 29, 2026
OpenSSL released updates **1.1.0d** and **1.0.2k** to address several Moderate-severity defects, including `CVE-2017-3731`, an integer-underflow out-of-bounds read that lets specially truncated TLS packets crash affected 32-bit clients or servers using vulnerable cipher suites such as RC4-MD5. The releases also addressed `CVE-2017-3730`, in which malicious DHE or ECDHE parameters can trigger a NULL-pointer dereference in clients, and `CVE-2017-3732`, a carry-propagation flaw in x86_64 Montgomery squaring that can yield incorrect cryptographic results. Exploiting the latter against RSA or DSA is considered highly impractical; a Diffie-Hellman attack is more feasible only under restrictive conditions involving unpatched systems, persistent shared DH parameters, and substantial resources. Red Hat shipped updated OpenSSL packages for RHEL 6 and 7 through **RHSA-2017:0286**, remediating `CVE-2017-3731` and `CVE-2016-8610`. The latter allows unauthenticated attackers to send large volumes of malformed plaintext TLS/SSL ALERT messages during handshakes, consuming server CPU and preventing new connections; Nginx deployments were identified as affected, while Apache HTTP Server was not. Organizations should apply the vendor updates, restart all services linked to OpenSSL or reboot hosts, disable RC4-MD5 where updates cannot be immediately deployed, and retire unsupported OpenSSL 1.0.1, 1.0.0, and 0.9.8 installations.
Aug 29, 2026
OpenSSL released fixes for seven vulnerabilities across multiple supported branches, led by **CVE-2026-31790**, a Moderate-severity flaw in RSA KEM `RSASVE` encapsulation that can leak stale or uninitialized memory to a malicious peer. The issue can be triggered when applications process attacker-supplied invalid RSA public keys without validating them first. The advisory also disclosed six Low-severity bugs: an AVX-512/VAES-specific out-of-bounds read in AES-CFB-128, a potential use-after-free or double-free in DANE client code, two CMS-related NULL pointer dereferences, a delta CRL NULL dereference, and a heap buffer overflow in hexadecimal conversion on 32-bit platforms. The project advised users to upgrade to fixed releases **3.0.20**, **3.3.7**, **3.4.5**, **3.5.6**, and **3.6.2**, with premium-support fixes available for **1.1.1zg** and **1.0.2zp** where applicable. OpenSSL said branches **3.1** and **3.2** are out of support and were not analyzed, leaving organizations running those versions without reviewed fixes in this advisory.
Jun 29, 2026