# OpenSSL vulnerabilities Source: https://junglewise.ai/threats/vendors/openssl Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/openssl.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 53 vulnerabilities in OpenSSL: 5 in the last 7 days and 29 in the last 90 days, 5 of them critical and 1 exploited in the wild. The most recent, CVE-2026-95692, was published on 10 November 2026. Nothing in the last four weeks, down from 15 vulnerabilities in the four before. 1 technology has a page of its own. ## Counts - Last 7 days: 5 - Last 30 days: 5 - Last 90 days: 29 - All time: 53 (5 critical, 1 exploited in the wild) ## About OpenSSL OpenSSL is an open-source software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end. ## Latest OpenSSL vulnerabilities - [CVE-2026-95692: OpenSSL AES-GCM-SIV heap out-of-bounds read in EVP_CipherInit_ex](https://junglewise.ai/threats/cve-2026-95692-issue-summary-setting-an-aes-gcm-siv-iv-shorter-than-the-expected) (info, published 10 Nov 2026) - [CVE-2026-95691: OpenSSL use-after-free in QUIC CRYPTO frame handling](https://junglewise.ai/threats/cve-2026-95691-issue-summary-a-retransmitted-quic-crypto-frame-can-release) (info, published 10 Nov 2026) - [CVE-2026-88823: OpenSSL AES-GCM-SIV authentication tag bypass in AAD processing](https://junglewise.ai/threats/cve-2026-88823-issue-summary-the-aes-gcm-siv-implementation-treats-a-zero-length) (info, published 10 Nov 2026) - [CVE-2026-88822: OpenSSL QUIC uninitialized stack data leak in peer detection](https://junglewise.ai/threats/cve-2026-88822-issue-summary-quic-when-performing-automated-peer-detection-may) (info, published 10 Nov 2026) - [CVE-2026-107496: OpenSSL infinite loop in CMS encryption with EC certificates](https://junglewise.ai/threats/cve-2026-107496-issue-summary-encrypting-a-cms-message-to-an-ec-certificate) (info, published 10 Nov 2026) - [CVE-2026-84784: OpenSSL QUIC denial of service via NEW_CONNECTION_ID frame flooding](https://junglewise.ai/threats/cve-2026-84784-issue-summary-a-malicious-remote-peer-may-flood-the-local-quic) (high, CVSS 7.5, published 29 Sep 2026) - [CVE-2026-84783: OpenSSL use-after-free in X.509 extension caching](https://junglewise.ai/threats/cve-2026-84783-issue-summary-the-first-concurrent-use-of-the-same-x-509) (high, CVSS 7.5, published 29 Sep 2026) - [CVE-2026-84782: OpenSSL out-of-bounds read in DTLS retransmission](https://junglewise.ai/threats/cve-2026-84782-issue-summary-the-dtls-retransmission-logic-does-not-correctly) (high, CVSS 8.2, published 29 Sep 2026) - [CVE-2026-77696: OpenSSL SM2 signature generation timing side-channel](https://junglewise.ai/threats/cve-2026-77696-issue-summary-sm2-signature-generation-uses-non-constant-time) (low, CVSS 3.7, published 29 Sep 2026) - [CVE-2026-75806: OpenSSL DTLS denial of service in AEAD record validation](https://junglewise.ai/threats/cve-2026-75806-issue-summary-an-established-dtls-1-2-association-using-an-aead) (medium, CVSS 5.3, published 29 Sep 2026) - [CVE-2026-75805: OpenSSL CMP client NULL pointer dereference in revocation](https://junglewise.ai/threats/cve-2026-75805-issue-summary-a-cmp-client-that-requests-certificate-revocation) (medium, CVSS 5.3, published 29 Sep 2026) - [CVE-2026-75804: OpenSSL QUIC stack memory exhaustion in flow control](https://junglewise.ai/threats/cve-2026-75804-issue-summary-openssl-quic-stack-does-not-enforce-connection) (info, published 29 Sep 2026) - [CVE-2026-72897: OpenSSL out-of-bounds read/write in SSL_set_SSL_CTX](https://junglewise.ai/threats/cve-2026-72897-issue-summary-a-tls-server-that-calls-ssl-set-ssl-ctx-to-switch-a) (info, published 29 Sep 2026) - [CVE-2026-54875: OpenSSL SM2 timing side-channel in scalar multiplication on ARM64 and RISC-V](https://junglewise.ai/threats/cve-2026-54875-issue-summary-a-non-constant-time-optimized-implementation-of) (info, published 29 Sep 2026) - [CVE-2026-54873: OpenSSL QUIC packet buffer memory exhaustion](https://junglewise.ai/threats/cve-2026-54873-issue-summary-quic-process-may-keep-memory-for-quic-packet-buffer) (info, published 29 Sep 2026) - [CVE-2026-54872: OpenSSL elliptic-curve scalar multiplication timing leak in ECDSA and SM2](https://junglewise.ai/threats/cve-2026-54872-issue-summary-the-generic-elliptic-curve-scalar-multiplication) (info, published 29 Sep 2026) - [CVE-2026-42772: OpenSSL quadratic complexity in QUIC stream reassembly](https://junglewise.ai/threats/cve-2026-42772-issue-summary-the-quic-stream-reassembly-algorithm-performance) (info, published 29 Sep 2026) - [CVE-2026-35191: OpenSSL QUIC packet credit miscounting in non-validation mode](https://junglewise.ai/threats/cve-2026-35191-issue-summary-the-openssl-quic-server-when-configured-to-not) (info, published 29 Sep 2026) - [CVE-2026-35189: OpenSSL heap growth in X.509 CRLDP processing](https://junglewise.ai/threats/cve-2026-35189-issue-summary-a-certificate-with-many-namerelativetocrlissuer-crl) (info, published 29 Sep 2026) - [CVE-2026-90439: NGINX Plus and Open Source HTTP/3 heap buffer overflow in TLS handshake](https://junglewise.ai/threats/cve-2026-90439-nginx-plus-and-open-source-http-3-heap-buffer-overflow-in-tls) (medium, CVSS 6.5, published 15 Sep 2026) - [CVE-2026-75803: OpenSSL ChaCha20-Poly1305 and AES-OCB authentication tag bypass](https://junglewise.ai/threats/cve-2026-75803-openssl-chacha20-poly1305-and-aes-ocb-authentication-tag-bypass) (critical, CVSS 9.1, published 25 Aug 2026) - [CVE-2026-63076: OpenSSL CMP password protection verification null pointer dereference](https://junglewise.ai/threats/cve-2026-63076-openssl-cmp-password-protection-verification-null-pointer) (high, CVSS 7.5, published 25 Aug 2026) - [CVE-2026-63075: OpenSSL QUIC memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-63075-openssl-quic-memory-exhaustion-denial-of-service) (high, CVSS 7.5, published 25 Aug 2026) - [CVE-2026-63074: OpenSSL CMP unbounded certificate cache growth](https://junglewise.ai/threats/cve-2026-63074-openssl-cmp-unbounded-certificate-cache-growth) (medium, CVSS 5.9, published 25 Aug 2026) - [CVE-2026-63073: OpenSSL CMP response validation format string](https://junglewise.ai/threats/cve-2026-63073-openssl-cmp-response-validation-format-string) (critical, CVSS 9.8, published 25 Aug 2026) ## Most severe OpenSSL vulnerabilities - [CVE-2014-0160: OpenSSL Information Disclosure Vulnerability](https://junglewise.ai/threats/cve-2014-0160-openssl-information-disclosure-vulnerability) (critical, exploited in the wild, CVSS 7.5, published 4 May 2022) - [CVE-2026-63073: OpenSSL CMP response validation format string](https://junglewise.ai/threats/cve-2026-63073-openssl-cmp-response-validation-format-string) (critical, CVSS 9.8, published 25 Aug 2026) - [CVE-2026-31789: OpenSSL heap buffer overflow in buf2hex conversion](https://junglewise.ai/threats/cve-2026-31789-openssl-heap-buffer-overflow-in-buf2hex-conversion) (critical, CVSS 9.8, published 7 Apr 2026) - [CVE-2026-75803: OpenSSL ChaCha20-Poly1305 and AES-OCB authentication tag bypass](https://junglewise.ai/threats/cve-2026-75803-openssl-chacha20-poly1305-and-aes-ocb-authentication-tag-bypass) (critical, CVSS 9.1, published 25 Aug 2026) - [CVE-2024-5535: OpenSSL buffer overread in SSL_select_next_proto](https://junglewise.ai/threats/cve-2024-5535-openssl-buffer-overread-in-ssl-select-next-proto) (critical, CVSS 9.1, published 27 Jun 2024) - [CVE-2026-84782: OpenSSL out-of-bounds read in DTLS retransmission](https://junglewise.ai/threats/cve-2026-84782-issue-summary-the-dtls-retransmission-logic-does-not-correctly) (high, CVSS 8.2, published 29 Sep 2026) - [CVE-2026-28387: OpenSSL use-after-free in DANE TLSA-based authentication](https://junglewise.ai/threats/cve-2026-28387-openssl-use-after-free-in-dane-tlsa-based-authentication) (high, CVSS 8.1, published 7 Apr 2026) - [CVE-2026-63076: OpenSSL CMP password protection verification null pointer dereference](https://junglewise.ai/threats/cve-2026-63076-openssl-cmp-password-protection-verification-null-pointer) (high, CVSS 7.5, published 25 Aug 2026) - [CVE-2026-18798: OpenSSL QUIC double free in QRX object](https://junglewise.ai/threats/cve-2026-18798-openssl-quic-double-free-in-qrx-object) (high, CVSS 7.5, published 25 Aug 2026) - [CVE-2026-54874: OpenSSL DTLS memory exhaustion in epoch buffering](https://junglewise.ai/threats/cve-2026-54874-openssl-dtls-memory-exhaustion-in-epoch-buffering) (high, CVSS 7.5, published 25 Aug 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 15 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 9 | 2 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 14 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 5 | 0 | 0 | ## OpenSSL technologies - [OpenSSL](https://junglewise.ai/threats/technologies/openssl): 80 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "OpenSSL vulnerabilities", https://junglewise.ai/threats/vendors/openssl, 12 November 2026.