{"kind": "product", "path": "vulns/alpine-v3.20/openssl", "name": "openssl", "product": "openssl", "ecosystem": "Alpine:v3.20", "items": [{"id": "ALPINE-CVE-2026-31790", "noindex": false, "published": "2026-04-07T22:16:21.770Z", "modified": "2026-10-01T02:17:49.235414637Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2026-31790", "title": "ALPINE-CVE-2026-31790", "description": "Issue summary: Applications using RSASVE key encapsulation to establish\na secret encryption key can send contents of an uninitialized memory buffer to\na malicious peer.\n\nImpact summary: The uninitialized buffer might contain sensitive data from the\nprevious execution of the application process which leads to sensitive data\nleakage to an attacker.\n\nRSA_public_encrypt() returns the number of bytes written on success and -1\non error. The affected code tests only whether the return value is non-zero.\nAs a result, if RSA encryption fails, encapsulation can still return success to\nthe caller, set the output lengths, and leave the caller to use the ", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-31790", "https://osv.dev/vulnerability/ALPINE-CVE-2026-31790"], "fixes": ["3.3.7-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2026-31789", "noindex": false, "published": "2026-04-07T22:16:21.617Z", "modified": "2026-10-01T02:17:49.235165278Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2026-31789", "title": "ALPINE-CVE-2026-31789", "description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-31789", "https://osv.dev/vulnerability/ALPINE-CVE-2026-31789"], "fixes": ["3.3.7-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2026-28390", "noindex": false, "published": "2026-04-07T22:16:21.190Z", "modified": "2026-10-01T02:17:49.226076719Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2026-28390", "title": "ALPINE-CVE-2026-28390", "description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-28390", "https://osv.dev/vulnerability/ALPINE-CVE-2026-28390"], "fixes": ["3.3.7-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2026-28389", "noindex": false, "published": "2026-04-07T22:16:21.030Z", "modified": "2026-10-01T02:17:49.225854712Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2026-28389", "title": "ALPINE-CVE-2026-28389", "description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MI", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-28389", "https://osv.dev/vulnerability/ALPINE-CVE-2026-28389"], "fixes": ["3.3.7-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2026-28388", "noindex": false, "published": "2026-04-07T22:16:20.863Z", "modified": "2026-10-01T02:17:49.225553510Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2026-28388", "title": "ALPINE-CVE-2026-28388", "description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires t", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-28388", "https://osv.dev/vulnerability/ALPINE-CVE-2026-28388"], "fixes": ["3.3.7-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2026-28387", "noindex": false, "published": "2026-04-07T22:16:20.700Z", "modified": "2026-10-01T02:17:49.225205101Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2026-28387", "title": "ALPINE-CVE-2026-28387", "description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat a", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-28387", "https://osv.dev/vulnerability/ALPINE-CVE-2026-28387"], "fixes": ["3.3.7-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2026-22796", "noindex": false, "published": "2026-01-27T16:16:35.543Z", "modified": "2026-10-01T02:17:49.208883150Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2026-22796", "title": "ALPINE-CVE-2026-22796", "description": "Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-22796", "https://osv.dev/vulnerability/ALPINE-CVE-2026-22796"], "fixes": ["3.3.6-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2026-22795", "noindex": false, "published": "2026-01-27T16:16:35.430Z", "modified": "2026-10-01T02:17:49.208882547Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2026-22795", "title": "ALPINE-CVE-2026-22795", "description": "Issue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zer", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-22795", "https://osv.dev/vulnerability/ALPINE-CVE-2026-22795"], "fixes": ["3.3.6-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2025-69421", "noindex": false, "published": "2026-01-27T16:16:34.437Z", "modified": "2026-08-27T22:18:03.058811482Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-69421", "title": "ALPINE-CVE-2025-69421", "description": "Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting th", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-69421", "https://osv.dev/vulnerability/ALPINE-CVE-2025-69421"], "fixes": ["3.3.6-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2025-69420", "noindex": false, "published": "2026-01-27T16:16:34.317Z", "modified": "2026-08-27T22:18:03.058187882Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-69420", "title": "ALPINE-CVE-2025-69420", "description": "Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value without validating its type.\nWhen the type is not ", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-69420", "https://osv.dev/vulnerability/ALPINE-CVE-2025-69420"], "fixes": ["3.3.6-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2025-69419", "noindex": false, "published": "2026-01-27T16:16:34.113Z", "modified": "2026-08-27T22:18:03.057400115Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-69419", "title": "ALPINE-CVE-2025-69419", "description": "Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously\ncrafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing\nnon-ASCII BMP code point can trigger a one byte write before the allocated\nbuffer.\n\nImpact summary: The out-of-bounds write can cause a memory corruption\nwhich can have various consequences including a Denial of Service.\n\nThe OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12\nBMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes,\nthe helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16\nsource byte count as the destination buffer capac", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-69419", "https://osv.dev/vulnerability/ALPINE-CVE-2025-69419"], "fixes": ["3.3.6-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2025-69418", "noindex": false, "published": "2026-01-27T16:16:33.253Z", "modified": "2026-08-27T22:18:03.055091734Z", "cvss": 4, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-69418", "title": "ALPINE-CVE-2025-69418", "description": "Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted and unauthenticated.<br><br>Impact summary: The trailing 1-15 bytes of a message may be exposed in<br>cleartext on encryption and are not covered by the authentication tag,<br>allowing an attacker to read or tamper with those bytes without detection.<br><br>The low-level OCB encrypt and decrypt routines in the hardware-accelerated<br>stream path process full 16-byte blocks but do not advance the input/output<br>pointers. The subseque", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-69418", "https://osv.dev/vulnerability/ALPINE-CVE-2025-69418"], "fixes": ["3.3.6-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2025-68160", "noindex": false, "published": "2026-01-27T16:16:15.900Z", "modified": "2026-08-27T22:18:03.052997299Z", "cvss": 4.7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-68160", "title": "ALPINE-CVE-2025-68160", "description": "Issue summary: Writing large, newline-free data into a BIO chain using the\nline-buffering filter where the next BIO performs short writes can trigger\na heap-based out-of-bounds write.\n\nImpact summary: This out-of-bounds write can cause memory corruption which\ntypically results in a crash, leading to Denial of Service for an application.\n\nThe line-buffering BIO filter (BIO_f_linebuffer) is not used by default in\nTLS/SSL data paths. In OpenSSL command-line applications, it is typically\nonly pushed onto stdout/stderr on VMS systems. Third-party applications that\nexplicitly use this filter with a BIO chain that can short-write and that\nwrite larg", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-68160", "https://osv.dev/vulnerability/ALPINE-CVE-2025-68160"], "fixes": ["3.3.6-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2025-66199", "noindex": false, "published": "2026-01-27T16:16:15.777Z", "modified": "2026-08-27T22:18:02.998160341Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-66199", "title": "ALPINE-CVE-2025-66199", "description": "Issue summary: A TLS 1.3 connection using certificate compression can be\nforced to allocate a large buffer before decompression without checking\nagainst the configured certificate size limit.\n\nImpact summary: An attacker can cause per-connection memory allocations of\nup to approximately 22 MiB and extra CPU work, potentially leading to\nservice degradation or resource exhaustion (Denial of Service).\n\nIn affected configurations, the peer-supplied uncompressed certificate\nlength from a CompressedCertificate message is used to grow a heap buffer\nprior to decompression. This length is not bounded by the max_cert_list\nsetting, which otherwise const", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-66199", "https://osv.dev/vulnerability/ALPINE-CVE-2025-66199"], "fixes": ["3.3.6-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2025-15468", "noindex": false, "published": "2026-01-27T16:16:14.400Z", "modified": "2026-08-27T22:18:02.775617009Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-15468", "title": "ALPINE-CVE-2025-15468", "description": "Issue summary: If an application using the SSL_CIPHER_find() function in\na QUIC protocol client or server receives an unknown cipher suite from\nthe peer, a NULL dereference occurs.\n\nImpact summary: A NULL pointer dereference leads to abnormal termination of\nthe running process causing Denial of Service.\n\nSome applications call SSL_CIPHER_find() from the client_hello_cb callback\non the cipher ID received from the peer. If this is done with an SSL object\nimplementing the QUIC protocol, NULL pointer dereference will happen if\nthe examined cipher ID is unknown or unsupported.\n\nAs it is not very common to call this function in applications using t", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-15468", "https://osv.dev/vulnerability/ALPINE-CVE-2025-15468"], "fixes": ["3.3.6-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2025-15467", "noindex": false, "published": "2026-01-27T16:16:14.257Z", "modified": "2026-08-27T22:18:02.775744657Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-15467", "title": "ALPINE-CVE-2025-15467", "description": "Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthent", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-15467", "https://osv.dev/vulnerability/ALPINE-CVE-2025-15467"], "fixes": ["3.3.6-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2025-9232", "noindex": false, "published": "2025-09-30T14:15:41.313Z", "modified": "2026-08-27T22:18:03.072941456Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-9232", "title": "ALPINE-CVE-2025-9232", "description": "Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-9232", "https://osv.dev/vulnerability/ALPINE-CVE-2025-9232"], "fixes": ["3.3.5-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2025-9231", "noindex": false, "published": "2025-09-30T14:15:41.190Z", "modified": "2026-08-27T22:18:03.072538890Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-9231", "title": "ALPINE-CVE-2025-9231", "description": "Issue summary: A timing side-channel which could potentially allow remote\nrecovery of the private key exists in the SM2 algorithm implementation on 64 bit\nARM platforms.\n\nImpact summary: A timing side-channel in SM2 signature computations on 64 bit\nARM platforms could allow recovering the private key by an attacker..\n\nWhile remote key recovery over a network was not attempted by the reporter,\ntiming measurements revealed a timing signal which may allow such an attack.\n\nOpenSSL does not directly support certificates with SM2 keys in TLS, and so\nthis CVE is not relevant in most TLS contexts.  However, given that it is\npossible to add support fo", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-9231", "https://osv.dev/vulnerability/ALPINE-CVE-2025-9231"], "fixes": ["3.3.5-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2025-9230", "noindex": false, "published": "2025-09-30T14:15:41.050Z", "modified": "2026-08-27T22:18:03.072238375Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-9230", "title": "ALPINE-CVE-2025-9230", "description": "Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-9230", "https://osv.dev/vulnerability/ALPINE-CVE-2025-9230"], "fixes": ["3.3.5-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}, {"id": "ALPINE-CVE-2024-12797", "noindex": false, "published": "2025-02-11T16:15:38.827Z", "modified": "2026-09-15T08:17:48.438506884Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-12797", "title": "ALPINE-CVE-2024-12797", "description": "Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a\nserver may fail to notice that the server was not authenticated, because\nhandshakes don't abort as expected when the SSL_VERIFY_PEER verification mode\nis set.\n\nImpact summary: TLS and DTLS connections using raw public keys may be\nvulnerable to man-in-middle attacks when server authentication failure is not\ndetected by clients.\n\nRPKs are disabled by default in both TLS clients and TLS servers.  The issue\nonly arises when TLS clients explicitly enable RPK use by the server, and the\nserver, likewise, enables sending of an RPK instead of an X.509 certificate\nchain.  The", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-12797", "https://osv.dev/vulnerability/ALPINE-CVE-2024-12797"], "fixes": ["3.3.3-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}]}], "total": 73, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 4, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "openssl", "path": "vulns/alpine-v3.20/openssl", "ecosystem": "Alpine:v3.20"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-01T02:17:49.235414637Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}