# openssl-src (crates.io) vulnerabilities

Source: https://junglewise.ai/threats/technologies/openssl-src  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/openssl-src.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 26 vulnerabilities in openssl-src (crates.io): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2023-0215, was published on 7 February 2023.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 0
- All time: 26 (0 critical, 0 exploited in the wild)

## About openssl-src (crates.io)

Rust crate providing Rust bindings and build integration for the OpenSSL cryptography library.

## Latest openssl-src (crates.io) vulnerabilities

- [CVE-2023-0215: RUSTSEC-2023-0009 - Use-after-free following `BIO_new_NDEF`](https://junglewise.ai/threats/cve-2023-0215-openssl-src-vulnerable-to-use-after-free-following-bio-new-ndef) (low, CVSS 3.1, published 7 Feb 2023)
- [CVE-2022-4203: RUSTSEC-2023-0008 - X.509 Name Constraints Read Buffer Overflow](https://junglewise.ai/threats/cve-2022-4203-openssl-src-contains-read-buffer-overflow-in-x-509-name-constraint) (low, CVSS 3.1, published 7 Feb 2023)
- [CVE-2023-0286: RUSTSEC-2023-0006 - X.400 address type confusion in X.509 `GeneralName`](https://junglewise.ai/threats/cve-2023-0286-vulnerable-openssl-included-in-cryptography-wheels) (low, CVSS 3.1, published 7 Feb 2023)
- [CVE-2023-0401: RUSTSEC-2023-0013 - `NULL` dereference during PKCS7 data verification](https://junglewise.ai/threats/cve-2023-0401-openssl-src-contains-null-dereference-during-pkcs7-data) (low, CVSS 3.1, published 7 Feb 2023)
- [CVE-2023-0217: RUSTSEC-2023-0012 - `NULL` dereference validating DSA public key](https://junglewise.ai/threats/cve-2023-0217-openssl-src-subject-to-null-dereference-validating-dsa-public-key) (low, CVSS 3.1, published 7 Feb 2023)
- [CVE-2023-0216: RUSTSEC-2023-0011 - Invalid pointer dereference in `d2i_PKCS7` functions](https://junglewise.ai/threats/cve-2023-0216-openssl-src-subject-to-invalid-pointer-dereference-in-d2i-pkcs7) (low, CVSS 3.1, published 7 Feb 2023)
- [CVE-2022-4304: RUSTSEC-2023-0007 - Timing Oracle in RSA Decryption](https://junglewise.ai/threats/cve-2022-4304-hitachi-energy-gms600-observable-discrepancy-in-openssl-rsa) (high, CVSS 3.1, published 7 Feb 2023)
- [CVE-2022-4450: RUSTSEC-2023-0010 - Double free after calling `PEM_read_bio_ex`](https://junglewise.ai/threats/cve-2022-4450-openssl-src-contains-double-free-after-calling-pem-read-bio-ex) (low, CVSS 3.1, published 7 Feb 2023)
- [CVE-2022-3996: Denial of service by double-checked locking in openssl-src](https://junglewise.ai/threats/cve-2022-3996-denial-of-service-by-double-checked-locking-in-openssl-src) (low, CVSS 3.1, published 13 Dec 2022)
- [CVE-2022-3602: RUSTSEC-2022-0064 - X.509 Email Address 4-byte Buffer Overflow](https://junglewise.ai/threats/cve-2022-3602-x-509-email-address-4-byte-buffer-overflow) (low, CVSS 3.1, published 1 Nov 2022)
- [CVE-2022-3786: RUSTSEC-2022-0065 - X.509 Email Address Variable Length Buffer Overflow](https://junglewise.ai/threats/cve-2022-3786-x-509-email-address-variable-length-buffer-overflow) (low, CVSS 3.1, published 1 Nov 2022)
- [CVE-2022-3358: RUSTSEC-2022-0059 - Using a Custom Cipher with `NID_undef` may lead to NULL encryption](https://junglewise.ai/threats/cve-2022-3358-using-a-custom-cipher-with-nid-undef-may-lead-to-null-encryption) (low, CVSS 3.1, published 11 Oct 2022)
- [CVE-2022-2274: RUSTSEC-2022-0033 - Heap memory corruption with RSA private key operation](https://junglewise.ai/threats/cve-2022-2274-openssl-src-heap-memory-corruption-with-rsa-private-key-operation) (low, CVSS 3.1, published 5 Jul 2022)
- [CVE-2022-2097: RUSTSEC-2022-0032 - AES OCB fails to encrypt some bytes](https://junglewise.ai/threats/cve-2022-2097-aes-ocb-fails-to-encrypt-some-bytes) (low, CVSS 3.1, published 5 Jul 2022)
- [CVE-2021-3712: Read buffer overruns processing ASN.1 strings](https://junglewise.ai/threats/cve-2021-3712-read-buffer-overruns-processing-asn-1-strings) (high, CVSS 7.4, published 24 May 2022)
- [CVE-2022-1434: RUSTSEC-2022-0026 - Incorrect MAC key used in the RC4-MD5 ciphersuite](https://junglewise.ai/threats/cve-2022-1434-incorrect-mac-key-used-in-the-rc4-md5-ciphersuite) (low, CVSS 3.1, published 3 May 2022)
- [CVE-2022-1473: RUSTSEC-2022-0025 - Resource leakage when decoding certificates and keys](https://junglewise.ai/threats/cve-2022-1473-resource-leakage-when-decoding-certificates-and-keys) (low, CVSS 3.1, published 3 May 2022)
- [CVE-2022-1343: RUSTSEC-2022-0027 - `OCSP_basic_verify` may incorrectly verify the response signing certificate](https://junglewise.ai/threats/cve-2022-1343-ocsp-basic-verify-may-incorrectly-verify-the-response-signing) (low, CVSS 3.1, published 3 May 2022)
- [CVE-2022-0778: RUSTSEC-2022-0014 - Infinite loop in `BN_mod_sqrt()` reachable when parsing certificates](https://junglewise.ai/threats/cve-2022-0778-openssl-src-s-infinite-loop-in-bn-mod-sqrt-reachable-when-parsing) (low, CVSS 3.1, published 15 Mar 2022)
- [CVE-2021-4044: RUSTSEC-2021-0129 - Invalid handling of `X509_verify_cert()` internal errors in libssl](https://junglewise.ai/threats/cve-2021-4044-invalid-handling-of-x509-verify-cert-internal-errors-in-libssl) (low, CVSS 3.1, published 14 Dec 2021)
- [CVE-2021-3711: RUSTSEC-2021-0097 - SM2 Decryption Buffer Overflow](https://junglewise.ai/threats/cve-2021-3711-sm2-decryption-buffer-overflow) (low, CVSS 3.1, published 24 Aug 2021)
- [CVE-2021-23841: RUSTSEC-2021-0058 - Null pointer deref in `X509_issuer_and_serial_hash()`](https://junglewise.ai/threats/cve-2021-23841-integer-overflow-in-openssl-src) (low, CVSS 3.1, published 1 May 2021)
- [CVE-2021-3450: RUSTSEC-2021-0056 - CA certificate check bypass with X509_V_FLAG_X509_STRICT](https://junglewise.ai/threats/cve-2021-3450-certificate-check-bypass-in-openssl-src) (low, CVSS 3.1, published 1 May 2021)
- [CVE-2021-3449: RUSTSEC-2021-0055 - NULL pointer deref in signature_algorithms processing](https://junglewise.ai/threats/cve-2021-3449-openssl-src-null-pointer-dereference-in-signature-algorithms) (low, CVSS 3.1, published 1 May 2021)
- [CVE-2021-23840: RUSTSEC-2021-0057 - Integer overflow in CipherUpdate](https://junglewise.ai/threats/cve-2021-23840-integer-overflow-in-openssl-src) (low, CVSS 3.1, published 1 May 2021)

## Most severe openssl-src (crates.io) vulnerabilities

- [CVE-2021-3712: Read buffer overruns processing ASN.1 strings](https://junglewise.ai/threats/cve-2021-3712-read-buffer-overruns-processing-asn-1-strings) (high, CVSS 7.4, published 24 May 2022)
- [CVE-2022-4304: RUSTSEC-2023-0007 - Timing Oracle in RSA Decryption](https://junglewise.ai/threats/cve-2022-4304-hitachi-energy-gms600-observable-discrepancy-in-openssl-rsa) (high, CVSS 3.1, published 7 Feb 2023)
- [CVE-2022-3786: RUSTSEC-2022-0065 - X.509 Email Address Variable Length Buffer Overflow](https://junglewise.ai/threats/cve-2022-3786-x-509-email-address-variable-length-buffer-overflow) (low, CVSS 3.1, published 1 Nov 2022)
- [CVE-2022-3602: RUSTSEC-2022-0064 - X.509 Email Address 4-byte Buffer Overflow](https://junglewise.ai/threats/cve-2022-3602-x-509-email-address-4-byte-buffer-overflow) (low, CVSS 3.1, published 1 Nov 2022)
- [CVE-2021-3711: RUSTSEC-2021-0097 - SM2 Decryption Buffer Overflow](https://junglewise.ai/threats/cve-2021-3711-sm2-decryption-buffer-overflow) (low, CVSS 3.1, published 24 Aug 2021)
- [CVE-2022-0778: RUSTSEC-2022-0014 - Infinite loop in `BN_mod_sqrt()` reachable when parsing certificates](https://junglewise.ai/threats/cve-2022-0778-openssl-src-s-infinite-loop-in-bn-mod-sqrt-reachable-when-parsing) (low, CVSS 3.1, published 15 Mar 2022)
- [CVE-2021-3449: RUSTSEC-2021-0055 - NULL pointer deref in signature_algorithms processing](https://junglewise.ai/threats/cve-2021-3449-openssl-src-null-pointer-dereference-in-signature-algorithms) (low, CVSS 3.1, published 1 May 2021)
- [CVE-2023-0286: RUSTSEC-2023-0006 - X.400 address type confusion in X.509 `GeneralName`](https://junglewise.ai/threats/cve-2023-0286-vulnerable-openssl-included-in-cryptography-wheels) (low, CVSS 3.1, published 7 Feb 2023)
- [CVE-2020-1967: RUSTSEC-2020-0015 - Crash causing Denial of Service attack](https://junglewise.ai/threats/cve-2020-1967-null-pointer-deference-in-openssl-src) (low, CVSS 3.1, published 25 Apr 2020)
- [CVE-2021-23840: RUSTSEC-2021-0057 - Integer overflow in CipherUpdate](https://junglewise.ai/threats/cve-2021-23840-integer-overflow-in-openssl-src) (low, CVSS 3.1, published 1 May 2021)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other crates.io technologies

- [surrealdb (crates.io)](https://junglewise.ai/threats/technologies/surrealdb): 83 vulnerabilities
- [wasmtime (crates.io)](https://junglewise.ai/threats/technologies/wasmtime): 67 vulnerabilities
- [deno (crates.io)](https://junglewise.ai/threats/technologies/deno): 39 vulnerabilities
- [zebrad (crates.io)](https://junglewise.ai/threats/technologies/zebrad): 27 vulnerabilities
- [russh (crates.io)](https://junglewise.ai/threats/technologies/crates-io-russh): 26 vulnerabilities
- [openssl (crates.io)](https://junglewise.ai/threats/technologies/crates-io-openssl): 25 vulnerabilities
- [rustfs (crates.io)](https://junglewise.ai/threats/technologies/rustfs): 25 vulnerabilities
- [coreutils (crates.io)](https://junglewise.ai/threats/technologies/crates-io-coreutils): 21 vulnerabilities
- [ckb (crates.io)](https://junglewise.ai/threats/technologies/ckb): 19 vulnerabilities
- [apollo-router (crates.io)](https://junglewise.ai/threats/technologies/apollo-router): 13 vulnerabilities
- [deepseek-tui (crates.io)](https://junglewise.ai/threats/technologies/deepseek-tui): 13 vulnerabilities
- [diesel (crates.io)](https://junglewise.ai/threats/technologies/diesel): 13 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "openssl-src (crates.io) vulnerabilities", https://junglewise.ai/threats/technologies/openssl-src, 9 November 2026.