Report feedback

An unauthenticated remote attacker can, by sending CMS messages, cause out-of-bounds memory access, which may result in a DoS attack, unauthorized access to data and potentially code execution. Exploiting the vulnerability requires the use of password-based encryption (PWRI), which is very rarely used.

The vulnerability is present in product:

• OpenSSL; >=1.0.2, <1.0.2zm; >=1.1.1, <1.1.1zd; >=3.0, <3.0.18; >=3.2, <3.2.6; >=3.3, <3.3.5; >=3.4, <3.4.3; >=3.5, <3.5.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

• CVE-2025-9230 at cve.org, NVD
• CWE-125: Out-of-bounds Read at cwe.mitre.org
• CWE-787: Out-of-bounds Write at cwe.mitre.org

The vulnerability was publicly disclosed 30. 9. 2025.

An unauthenticated remote attacker can exploit a timing side channel and thus potentially obtain the victim's private key. The vulnerability can be exploited only on the 64-bit ARM platform using the SM2 algorithm, which OpenSSL does not support natively [1].

The vulnerability is present in product:

• OpenSSL; >=3.2, <3.2.6; >=3.3, <3.3.5; >=3.4, <3.4.3; >=3.5, <3.5.4;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

• CVE-2025-9231 at cve.org, NVD
• CWE-385: Covert Timing Channel at cwe.mitre.org

The vulnerability was publicly disclosed 30. 9. 2025.

Using social engineering, an unauthenticated remote attacker can read beyond the bounds of allocated memory in the HTTP API, which may lead to a DoS attack. To exploit the vulnerability, the "no_proxy" environment variable must be set and an IPv6 address must be used in the authoritative host part of the URL [1].

The vulnerability is present in product:

• OpenSSL; >=3.0, <3.0.18; >=3.2, <3.2.6; >=3.3, <3.3.5; >=3.4, <3.4.3; >=3.5, <3.5.4;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2025-9232 at cve.org, NVD
• CWE-125: Out-of-bounds Read at cwe.mitre.org

The vulnerability was publicly disclosed 30. 9. 2025.