{"kind": "product", "path": "vulns/alpine-v3.17/openssl", "name": "openssl", "product": "openssl", "ecosystem": "Alpine:v3.17", "items": [{"id": "ALPINE-CVE-2026-22796", "noindex": false, "published": "2026-01-27T16:16:35.543Z", "modified": "2026-10-01T02:17:49.208883150Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2026-22796", "title": "ALPINE-CVE-2026-22796", "description": "Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-22796", "https://osv.dev/vulnerability/ALPINE-CVE-2026-22796"], "fixes": ["3.0.19-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2026-22795", "noindex": false, "published": "2026-01-27T16:16:35.430Z", "modified": "2026-10-01T02:17:49.208882547Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2026-22795", "title": "ALPINE-CVE-2026-22795", "description": "Issue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zer", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-22795", "https://osv.dev/vulnerability/ALPINE-CVE-2026-22795"], "fixes": ["3.0.19-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2025-69421", "noindex": false, "published": "2026-01-27T16:16:34.437Z", "modified": "2026-08-27T22:18:03.058811482Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-69421", "title": "ALPINE-CVE-2025-69421", "description": "Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting th", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-69421", "https://osv.dev/vulnerability/ALPINE-CVE-2025-69421"], "fixes": ["3.0.19-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2025-69420", "noindex": false, "published": "2026-01-27T16:16:34.317Z", "modified": "2026-08-27T22:18:03.058187882Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-69420", "title": "ALPINE-CVE-2025-69420", "description": "Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value without validating its type.\nWhen the type is not ", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-69420", "https://osv.dev/vulnerability/ALPINE-CVE-2025-69420"], "fixes": ["3.0.19-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2025-69419", "noindex": false, "published": "2026-01-27T16:16:34.113Z", "modified": "2026-08-27T22:18:03.057400115Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-69419", "title": "ALPINE-CVE-2025-69419", "description": "Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously\ncrafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing\nnon-ASCII BMP code point can trigger a one byte write before the allocated\nbuffer.\n\nImpact summary: The out-of-bounds write can cause a memory corruption\nwhich can have various consequences including a Denial of Service.\n\nThe OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12\nBMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes,\nthe helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16\nsource byte count as the destination buffer capac", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-69419", "https://osv.dev/vulnerability/ALPINE-CVE-2025-69419"], "fixes": ["3.0.19-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2025-69418", "noindex": false, "published": "2026-01-27T16:16:33.253Z", "modified": "2026-08-27T22:18:03.055091734Z", "cvss": 4, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-69418", "title": "ALPINE-CVE-2025-69418", "description": "Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted and unauthenticated.<br><br>Impact summary: The trailing 1-15 bytes of a message may be exposed in<br>cleartext on encryption and are not covered by the authentication tag,<br>allowing an attacker to read or tamper with those bytes without detection.<br><br>The low-level OCB encrypt and decrypt routines in the hardware-accelerated<br>stream path process full 16-byte blocks but do not advance the input/output<br>pointers. The subseque", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-69418", "https://osv.dev/vulnerability/ALPINE-CVE-2025-69418"], "fixes": ["3.0.19-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2025-68160", "noindex": false, "published": "2026-01-27T16:16:15.900Z", "modified": "2026-08-27T22:18:03.052997299Z", "cvss": 4.7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-68160", "title": "ALPINE-CVE-2025-68160", "description": "Issue summary: Writing large, newline-free data into a BIO chain using the\nline-buffering filter where the next BIO performs short writes can trigger\na heap-based out-of-bounds write.\n\nImpact summary: This out-of-bounds write can cause memory corruption which\ntypically results in a crash, leading to Denial of Service for an application.\n\nThe line-buffering BIO filter (BIO_f_linebuffer) is not used by default in\nTLS/SSL data paths. In OpenSSL command-line applications, it is typically\nonly pushed onto stdout/stderr on VMS systems. Third-party applications that\nexplicitly use this filter with a BIO chain that can short-write and that\nwrite larg", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-68160", "https://osv.dev/vulnerability/ALPINE-CVE-2025-68160"], "fixes": ["3.0.19-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2025-15467", "noindex": false, "published": "2026-01-27T16:16:14.257Z", "modified": "2026-08-27T22:18:02.775744657Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-15467", "title": "ALPINE-CVE-2025-15467", "description": "Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthent", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-15467", "https://osv.dev/vulnerability/ALPINE-CVE-2025-15467"], "fixes": ["3.0.19-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2025-9232", "noindex": false, "published": "2025-09-30T14:15:41.313Z", "modified": "2026-08-27T22:18:03.072941456Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-9232", "title": "ALPINE-CVE-2025-9232", "description": "Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-9232", "https://osv.dev/vulnerability/ALPINE-CVE-2025-9232"], "fixes": ["3.0.19-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2025-9230", "noindex": false, "published": "2025-09-30T14:15:41.050Z", "modified": "2026-08-27T22:18:03.072238375Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-9230", "title": "ALPINE-CVE-2025-9230", "description": "Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-9230", "https://osv.dev/vulnerability/ALPINE-CVE-2025-9230"], "fixes": ["3.0.19-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2024-13176", "noindex": false, "published": "2025-01-20T14:15:26.247Z", "modified": "2026-09-15T08:17:48.438722845Z", "cvss": 4.1, "cvss_vector": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-13176", "title": "ALPINE-CVE-2024-13176", "description": "Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is ", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-13176", "https://osv.dev/vulnerability/ALPINE-CVE-2024-13176"], "fixes": ["3.0.19-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2024-4741", "noindex": false, "published": "2024-11-13T11:15:04.480Z", "modified": "2026-09-15T08:17:48.483710190Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-4741", "title": "ALPINE-CVE-2024-4741", "description": "Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incomin", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-4741", "https://osv.dev/vulnerability/ALPINE-CVE-2024-4741"], "fixes": ["3.0.14-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2024-9143", "noindex": false, "published": "2024-10-16T17:15:18.130Z", "modified": "2026-09-15T08:17:48.503435788Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-9143", "title": "ALPINE-CVE-2024-9143", "description": "Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we're aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can't represent\nproblematic input values. Thus the likelihood of existence of a vulnerable\napplication is low.\n", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-9143", "https://osv.dev/vulnerability/ALPINE-CVE-2024-9143"], "fixes": ["3.0.15-r1"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2024-6119", "noindex": false, "published": "2024-09-03T16:15:07.177Z", "modified": "2026-09-15T08:17:48.497829189Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-6119", "title": "ALPINE-CVE-2024-6119", "description": "Issue summary: Applications performing certificate name checks (e.g., TLS\nclients checking server certificates) may attempt to read an invalid memory\naddress resulting in abnormal termination of the application process.\n\nImpact summary: Abnormal termination of an application can a cause a denial of\nservice.\n\nApplications performing certificate name checks (e.g., TLS clients checking\nserver certificates) may attempt to read an invalid memory address when\ncomparing the expected name with an `otherName` subject alternative name of an\nX.509 certificate. This may result in an exception that terminates the\napplication program.\n\nNote that basic cert", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-6119", "https://osv.dev/vulnerability/ALPINE-CVE-2024-6119"], "fixes": ["3.0.15-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2024-5535", "noindex": false, "published": "2024-06-27T11:15:24.447Z", "modified": "2026-09-15T08:17:48.494704960Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-5535", "title": "ALPINE-CVE-2024-5535", "description": "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally neve", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-5535", "https://osv.dev/vulnerability/ALPINE-CVE-2024-5535"], "fixes": ["3.0.14-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2024-4603", "noindex": false, "published": "2024-05-16T16:15:10.643Z", "modified": "2026-09-15T08:17:48.481227629Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-4603", "title": "ALPINE-CVE-2024-4603", "description": "Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-4603", "https://osv.dev/vulnerability/ALPINE-CVE-2024-4603"], "fixes": ["3.0.13-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2023-6237", "noindex": false, "published": "2024-04-25T07:15:45.270Z", "modified": "2026-10-23T17:17:56.820669430Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2023-6237", "title": "ALPINE-CVE-2023-6237", "description": "Issue summary: Checking excessively long invalid RSA public keys may take\na long time.\n\nImpact summary: Applications that use the function EVP_PKEY_public_check()\nto check RSA public keys may experience long delays. Where the key that\nis being checked has been obtained from an untrusted source this may lead\nto a Denial of Service.\n\nWhen function EVP_PKEY_public_check() is called on RSA public keys,\na computation is done to confirm that the RSA modulus, n, is composite.\nFor valid RSA keys, n is a product of two or more large primes and this\ncomputation completes quickly. However, if n is an overly large prime,\nthen this computation would take ", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-6237", "https://osv.dev/vulnerability/ALPINE-CVE-2023-6237"], "fixes": ["3.0.12-r3"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2024-2511", "noindex": false, "published": "2024-04-08T14:15:07.660Z", "modified": "2026-09-15T08:17:48.450036681Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-2511", "title": "ALPINE-CVE-2024-2511", "description": "Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unb", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-2511", "https://osv.dev/vulnerability/ALPINE-CVE-2024-2511"], "fixes": ["3.0.12-r5"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2024-0727", "noindex": false, "published": "2024-01-26T09:15:07.637Z", "modified": "2026-09-15T08:17:48.429885468Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-0727", "title": "ALPINE-CVE-2024-0727", "description": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application wi", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-0727", "https://osv.dev/vulnerability/ALPINE-CVE-2024-0727"], "fixes": ["3.0.12-r4"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}, {"id": "ALPINE-CVE-2023-6129", "noindex": false, "published": "2024-01-09T17:15:12.147Z", "modified": "2026-10-23T17:17:56.820412834Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2023-6129", "title": "ALPINE-CVE-2023-6129", "description": "Issue summary: The POLY1305 MAC (message authentication code) implementation\ncontains a bug that might corrupt the internal state of applications running\non PowerPC CPU based platforms if the CPU provides vector instructions.\n\nImpact summary: If an attacker can influence whether the POLY1305 MAC\nalgorithm is used, the application state might be corrupted with various\napplication dependent consequences.\n\nThe POLY1305 MAC (message authentication code) implementation in OpenSSL for\nPowerPC CPUs restores the contents of vector registers in a different order\nthan they are saved. Thus the contents of some of these vector registers\nare corrupted whe", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-6129", "https://osv.dev/vulnerability/ALPINE-CVE-2023-6129"], "fixes": ["3.0.12-r2"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}]}], "total": 64, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 4, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "openssl", "path": "vulns/alpine-v3.17/openssl", "ecosystem": "Alpine:v3.17"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-23T17:17:56.820669430Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}