Description
Issue summary: An application using the OpenSSL HTTP client API functions may
trigger an out-of-bounds read if the 'no_proxy' environment variable is set and
the host portion of the authority component of the HTTP URL is an IPv6 address.
Impact summary: An out-of-bounds read can trigger a crash which leads to
Denial of Service for an application.
The OpenSSL HTTP client API functions can be used directly by applications
but they are also used by the OCSP client functions and CMP (Certificate
Management Protocol) client implementation in OpenSSL. However the URLs used
by these implementations are unlikely to be controlled by an attacker.
In this vulnerable code the out of bounds read can only trigger a crash.
Furthermore the vulnerability requires an attacker-controlled URL to be
passed from an application to the OpenSSL function and the user has to have
a 'no_proxy' environment variable set. For the aforementioned reasons the
issue was assessed as Low severity.
The vulnerable code was introduced in the following patch releases:
3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
issue, as the HTTP client implementation is outside the OpenSSL FIPS module
boundary.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenSSL | OpenSSL | 3.5.0 – < 3.5.4, 3.4.0 – < 3.4.3, 3.3.3 – < 3.3.5, 3.2.4 – < 3.2.6, 3.0.16 – < 3.0.18 | 3.5.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 3.5.4-1 | — |
| Debian 13 | openssl | 3.5.1-1+deb13u1 | DSA-6015-1 |
| Debian 12 | openssl | 3.0.17-1~deb12u3 | DSA-6015-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | edk2 | 2025.02-8ubuntu3 | — |
| Ubuntu 26.04 LTS | openssl | 3.5.3-1ubuntu2 | — |
| Ubuntu 25.10 | edk2 | 2025.02-8ubuntu3 | — |
| Ubuntu 25.10 | openssl | 3.5.3-1ubuntu2 | — |
| Ubuntu 24.04 LTS | edk2 | 2024.02-2ubuntu0.6 | USN-7894-1 |
| Ubuntu 24.04 LTS | openssl | 3.0.13-0ubuntu3.6 | USN-7786-1 |
| Ubuntu 22.04 LTS | edk2 | 2022.02-3ubuntu0.22.04.4 | USN-7894-1 |
| Ubuntu 22.04 LTS | openssl | 3.0.2-0ubuntu1.20 | USN-7786-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 20.04 LTS | openssl | 1.1.1f-1ubuntu2.24+esm1 | USN-7786-1 |
| Ubuntu Pro 18.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 18.04 LTS | openssl | 1.1.1-1ubuntu2.1~18.04.23+esm6 | USN-7786-1 |
| Ubuntu Pro 18.04 LTS | openssl1.0 | 1.0.2n-1ubuntu5.13+esm2 | USN-7786-1 |
| Ubuntu Pro 16.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 16.04 LTS | openssl | 1.0.2g-1ubuntu4.20+esm13 | USN-7786-1 |
| Ubuntu Pro 14.04 LTS | openssl | 1.0.1f-1ubuntu2.27+esm11 | USN-7786-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | openssl +5 | 3.5.6-0.1.hum1 | RHSA-2026:7261 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | openssl-3 | 3.5.0-160000.4.1 | SUSE-SU-2025:21213-1 |
| SLES 16.0 | openssl-3 | 3.5.0-160000.4.1 | SUSE-SU-2025:21213-1 |
| SLE Micro 6.2 | openssl-3 | 3.5.0-160000.4.1 | SUSE-SU-2025:21224-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-3 | 3.5.3-2.1 | openSUSE-SU-2026:10237-1 |
| openSUSE Tumbleweed | regclient | 0.10.0-1.1 | openSUSE-SU-2025:15723-1 |
| openSUSE Leap 16.0 | openssl-3 | 3.5.0-160000.4.1 | openSUSE-SU-2025:20164-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openssl | 3.5.4-r0 | — |
| Alpine v3.23 | openssl | 3.5.4-r0 | — |
| Alpine v3.22 | openssl | 3.5.4-r0 | — |
| Alpine v3.21 | openssl | 3.3.5-r0 | — |
| Alpine v3.20 | openssl | 3.3.5-r0 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | openssl | 3.1.8-r1 | — |
| Alpine v3.17 | openssl | 3.0.19-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | openssl | 3.3.5-1 | — |
| Azure Linux 3 | openssl-fips-provider | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | openssl | 3.5.4-r0 | — |
Advisories 27
- USN-7894-1 edk2 vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-7786-1 openssl, openssl1.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- RHSA-2026:7261 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- SSA-082556 SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2025-2166 OpenSSL und LibreSSL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 27, 2026
- ICSA-26-202-04 Siemens SIDIS Secured SmartPlug CISA ICS & IT advisories · Jul 21, 2026
- NCSC-2026-0229 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jul 14, 2026
- SSA-585531 SSA-585531: Multiple Vulnerabilities in SIDIS Secured SmartPlug before V7.26.0310 Siemens ProductCERT · Jul 14, 2026
- ICSA-26-188-05 Siemens SINEC OS CISA ICS & IT advisories · Jul 7, 2026
- SSA-253495 SSA-253495: Multiple Vulnerabilities in SINEC OS before V4.0 Siemens ProductCERT · Jun 2, 2026
- ICSA-26-134-10 Siemens SIMATIC CISA ICS & IT advisories · May 14, 2026
- ICSA-25-162-05 Siemens SIMATIC S7-1500 CPU family CISA ICS & IT advisories · May 14, 2026
- NCSC-2026-0147 Kwetsbaarheden verholpen in Siemens-producten NCSC-NL (Netherlands) · May 13, 2026
- SSA-032379 SSA-032379: Multiple Vulnerabilities in SIMATIC CN 4100 Before V5.0 Siemens ProductCERT · May 12, 2026
- openSUSE-SU-2026:10237-1 libopenssl-3-devel-3.5.3-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:20164-1 Security update for openssl-3 SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15723-1 regclient-0.10.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21224-1 Security update for openssl-3 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21213-1 Security update for openssl-3 SUSE / openSUSE Security Updates · Mar 23, 2026
- NCSC-2026-0091 Kwetsbaarheden verholpen in SAP-producten NCSC-NL (Netherlands) · Mar 12, 2026
- ICSA-26-071-03 Siemens SIDIS Prime CISA ICS & IT advisories · Mar 12, 2026
- NCSC-2026-0079 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Mar 10, 2026
- SSA-485750 SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800 Siemens ProductCERT · Mar 10, 2026
- WID-SEC-2026-0647 SAP Patchday März 2026: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 9, 2026
- ICSA-26-043-06 Siemens SINEC OS CISA ICS & IT advisories · Feb 25, 2026
- SSA-089022 SSA-089022: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.3 Siemens ProductCERT · Feb 24, 2026
- DSA-6015-1 openssl - security update Debian Security (DSA / DLA) · Oct 1, 2025
References
- OpenSSL Advisory vendor-advisory
- 3.5.4 git commit patch
- 3.4.3 git commit patch
- 3.3.5 git commit patch
- 3.2.6 git commit patch
- 3.0.18 git commit patch