Technology · crates.io

openssl-src (crates.io) vulnerabilities

Updated 27 September 2026, 03:07 UTC. Rebuilt every hour.

Junglewise Threat Intelligence has tracked 26 vulnerabilities in openssl-src (crates.io): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2023-0215, was published on 7 February 2023.

Last 7 days: 0
Last 90 days: 0
Critical, all time: 0
Exploited in the wild: 0

About openssl-src (crates.io)

The openssl-src crate provides the source code of OpenSSL and logic to build it for Rust applications.

Homepage

Latest openssl-src (crates.io) vulnerabilities

CVE-2023-0215: RUSTSEC-2023-0009 - Use-after-free following `BIO_new_NDEF`lowCVSS 3.1EPSS 4.5%7 Feb 2023
CVE-2022-4203: RUSTSEC-2023-0008 - X.509 Name Constraints Read Buffer OverflowlowCVSS 3.1EPSS 1.4%7 Feb 2023
CVE-2023-0286: RUSTSEC-2023-0006 - X.400 address type confusion in X.509 `GeneralName`lowCVSS 3.1EPSS 59.5%7 Feb 2023
CVE-2023-0401: RUSTSEC-2023-0013 - `NULL` dereference during PKCS7 data verificationlowCVSS 3.1EPSS 1.8%7 Feb 2023
CVE-2023-0217: RUSTSEC-2023-0012 - `NULL` dereference validating DSA public keylowCVSS 3.1EPSS 1.8%7 Feb 2023
CVE-2023-0216: RUSTSEC-2023-0011 - Invalid pointer dereference in `d2i_PKCS7` functionslowCVSS 3.1EPSS 1.8%7 Feb 2023
CVE-2022-4304: RUSTSEC-2023-0007 - Timing Oracle in RSA DecryptionhighCVSS 3.1EPSS 16.2%7 Feb 2023
CVE-2022-4450: RUSTSEC-2023-0010 - Double free after calling `PEM_read_bio_ex`lowCVSS 3.1EPSS 20.4%7 Feb 2023
CVE-2022-3996: Denial of service by double-checked locking in openssl-srclowCVSS 3.1EPSS 1.3%13 Dec 2022
CVE-2022-3602: RUSTSEC-2022-0064 - X.509 Email Address 4-byte Buffer OverflowlowCVSS 3.1EPSS 90.8%1 Nov 2022
CVE-2022-3786: RUSTSEC-2022-0065 - X.509 Email Address Variable Length Buffer OverflowlowCVSS 3.1EPSS 92.5%1 Nov 2022
CVE-2022-3358: RUSTSEC-2022-0059 - Using a Custom Cipher with `NID_undef` may lead to NULL encryptionlowCVSS 3.1EPSS 3.2%11 Oct 2022
CVE-2022-2274: RUSTSEC-2022-0033 - Heap memory corruption with RSA private key operationlowCVSS 3.1EPSS 45.7%5 Jul 2022
CVE-2022-2097: RUSTSEC-2022-0032 - AES OCB fails to encrypt some byteslowCVSS 3.1EPSS 4.9%5 Jul 2022
CVE-2021-3712: Read buffer overruns processing ASN.1 stringshighCVSS 7.4EPSS 50.4%24 May 2022
CVE-2022-1434: RUSTSEC-2022-0026 - Incorrect MAC key used in the RC4-MD5 ciphersuitelowCVSS 3.1EPSS 1.1%3 May 2022
CVE-2022-1473: RUSTSEC-2022-0025 - Resource leakage when decoding certificates and keyslowCVSS 3.1EPSS 2.5%3 May 2022
CVE-2022-1343: RUSTSEC-2022-0027 - `OCSP_basic_verify` may incorrectly verify the response signing certificatelowCVSS 3.1EPSS 1.2%3 May 2022
CVE-2022-0778: RUSTSEC-2022-0014 - Infinite loop in `BN_mod_sqrt()` reachable when parsing certificateslowCVSS 3.1EPSS 73.2%15 Mar 2022
CVE-2021-4044: RUSTSEC-2021-0129 - Invalid handling of `X509_verify_cert()` internal errors in libssllowCVSS 3.1EPSS 50.1%14 Dec 2021
CVE-2021-3711: RUSTSEC-2021-0097 - SM2 Decryption Buffer OverflowlowCVSS 3.1EPSS 87.8%24 Aug 2021
CVE-2021-23841: RUSTSEC-2021-0058 - Null pointer deref in `X509_issuer_and_serial_hash()`lowCVSS 3.1EPSS 7.4%1 May 2021
CVE-2021-3450: RUSTSEC-2021-0056 - CA certificate check bypass with X509_V_FLAG_X509_STRICTlowCVSS 3.1EPSS 18.3%1 May 2021
CVE-2021-3449: RUSTSEC-2021-0055 - NULL pointer deref in signature_algorithms processinglowCVSS 3.1EPSS 63.5%1 May 2021
CVE-2021-23840: RUSTSEC-2021-0057 - Integer overflow in CipherUpdatelowCVSS 3.1EPSS 50.7%1 May 2021

Most severe openssl-src (crates.io) vulnerabilities

Exploited in the wild first, then by severity and CVSS score.

CVE-2021-3712: Read buffer overruns processing ASN.1 stringshighCVSS 7.4EPSS 50.4%24 May 2022
CVE-2022-4304: RUSTSEC-2023-0007 - Timing Oracle in RSA DecryptionhighCVSS 3.1EPSS 16.2%7 Feb 2023
CVE-2022-3786: RUSTSEC-2022-0065 - X.509 Email Address Variable Length Buffer OverflowlowCVSS 3.1EPSS 92.5%1 Nov 2022
CVE-2022-3602: RUSTSEC-2022-0064 - X.509 Email Address 4-byte Buffer OverflowlowCVSS 3.1EPSS 90.8%1 Nov 2022
CVE-2021-3711: RUSTSEC-2021-0097 - SM2 Decryption Buffer OverflowlowCVSS 3.1EPSS 87.8%24 Aug 2021
CVE-2022-0778: RUSTSEC-2022-0014 - Infinite loop in `BN_mod_sqrt()` reachable when parsing certificateslowCVSS 3.1EPSS 73.2%15 Mar 2022
CVE-2021-3449: RUSTSEC-2021-0055 - NULL pointer deref in signature_algorithms processinglowCVSS 3.1EPSS 63.5%1 May 2021
CVE-2023-0286: RUSTSEC-2023-0006 - X.400 address type confusion in X.509 `GeneralName`lowCVSS 3.1EPSS 59.5%7 Feb 2023
CVE-2020-1967: RUSTSEC-2020-0015 - Crash causing Denial of Service attacklowCVSS 3.1EPSS 53.3%25 Apr 2020
CVE-2021-23840: RUSTSEC-2021-0057 - Integer overflow in CipherUpdatelowCVSS 3.1EPSS 50.7%1 May 2021

Vulnerabilities per week

The last 13 weeks, by the week each vulnerability was published.

Vulnerabilities published per week, UTC
Week of	Bar	Vulns	Critical
29 Jun 2026		0	0
6 Jul 2026		0	0
13 Jul 2026		0	0
20 Jul 2026		0	0
27 Jul 2026		0	0
3 Aug 2026		0	0
10 Aug 2026		0	0
17 Aug 2026		0	0
24 Aug 2026		0	0
31 Aug 2026		0	0
7 Sep 2026		0	0
14 Sep 2026		0	0
21 Sep 2026		0	0

How this is built

Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.

The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.

Use this data

The same data is at https://junglewise.ai/threats/technologies/openssl-src.json, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.

Cite as: Junglewise Threat Intelligence, "openssl-src (crates.io) vulnerabilities", https://junglewise.ai/threats/technologies/openssl-src, 27 September 2026.