Every CVE Search/ Get API key

CVE-2025-66199

TLS 1.3 CompressedCertificate excessive memory allocation

5.9 MediumFix available

Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit.

Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service).

In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate message is used to grow a heap buffer prior to decompression. This length is not bounded by the max_cert_list setting, which otherwise constrains certificate message sizes. An attacker can exploit this to cause large per-connection allocations followed by handshake failure. No memory corruption or information disclosure occurs.

This issue only affects builds where TLS 1.3 certificate compression is compiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression algorithm (brotli, zlib, or zstd) is available, and where the compression extension is negotiated. Both clients receiving a server CompressedCertificate and servers in mutual TLS scenarios receiving a client CompressedCertificate are affected. Servers that do not request client certificates are not vulnerable to client-initiated attacks.

Users can mitigate this issue by setting SSL_OP_NO_RX_CERTIFICATE_COMPRESSION to disable receiving compressed certificates.

The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the TLS implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.

OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.46%Up 0.4 points since Jan 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.9

TLS 1.3 CompressedCertificate excessive memory allocation

Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit.

Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service).

In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate message is used to grow a heap buffer prior to decompression. This length is not bounded by the max_cert_list setting, which otherwise constrains certificate message sizes. An attacker can exploit this to cause large per-connection allocations followed by handshake failure. No memory corruption or information disclosure occurs.

This issue only affects builds where TLS 1.3 certificate compression is compiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression algorithm (brotli, zlib, or zstd) is available, and where the compression extension is negotiated. Both clients receiving a server CompressedCertificate and servers in mutual TLS scenarios receiving a client CompressedCertificate are affected. Servers that do not request client certificates are not vulnerable to client-initiated attacks.

Users can mitigate this issue by setting SSL_OP_NO_RX_CERTIFICATE_COMPRESSION to disable receiving compressed certificates.

The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the TLS implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.

OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

Record
CVE-2025-66199
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-789
Updated
2026-11-02
EUVDEUVD-2025-206398 5.9

Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit.

Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service).

In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate message is used to grow a heap buffer prior to decompression. This length is not bounded by the max_cert_list setting, which otherwise constrains certificate message sizes. An attacker can exploit this to cause large per-connection allocations followed by handshake failure. No memory corruption or information disclosure occurs.

This issue only affects builds where TLS 1.3 certificate compression is compiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression algorithm (brotli, zlib, or zstd) is available, and where the compression extension is negotiated. Both clients receiving a server CompressedCertificate and servers in mutual TLS scenarios receiving a client CompressedCertificate are affected. Servers that do not request client certificates are not vulnerable to client-initiated attacks.

Users can mitigate this issue by setting SSL_OP_NO_RX_CERTIFICATE_COMPRESSION to disable receiving compressed certificates.

The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the TLS implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.

OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

Record
EUVD-2025-206398
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-5888-36j9-c92p 5.9

Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a...

Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit.

Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service).

In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate message is used to grow a heap buffer prior to decompression. This length is not bounded by the max_cert_list setting, which otherwise constrains certificate message sizes. An attacker can exploit this to cause large per-connection allocations followed by handshake failure. No memory corruption or information disclosure occurs.

This issue only affects builds where TLS 1.3 certificate compression is compiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression algorithm (brotli, zlib, or zstd) is available, and where the compression extension is negotiated. Both clients receiving a server CompressedCertificate and servers in mutual TLS scenarios receiving a client CompressedCertificate are affected. Servers that do not request client certificates are not vulnerable to client-initiated attacks.

Users can mitigate this issue by setting SSL_OP_NO_RX_CERTIFICATE_COMPRESSION to disable receiving compressed certificates.

The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the TLS implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.

OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

Record
GHSA-5888-36j9-c92p
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-789
Updated
2026-11-02
NVD 5.9

Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit.

Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service).

In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate message is used to grow a heap buffer prior to decompression. This length is not bounded by the max_cert_list setting, which otherwise constrains certificate message sizes. An attacker can exploit this to cause large per-connection allocations followed by handshake failure. No memory corruption or information disclosure occurs.

This issue only affects builds where TLS 1.3 certificate compression is compiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression algorithm (brotli, zlib, or zstd) is available, and where the compression extension is negotiated. Both clients receiving a server CompressedCertificate and servers in mutual TLS scenarios receiving a client CompressedCertificate are affected. Servers that do not request client certificates are not vulnerable to client-initiated attacks.

Users can mitigate this issue by setting SSL_OP_NO_RX_CERTIFICATE_COMPRESSION to disable receiving compressed certificates.

The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the TLS implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.

OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

Record
CVE-2025-66199
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-789
Updated
2026-11-02
OSVALPINE-CVE-2025-66199 5.9

Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit.

Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service).

In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate message is used to grow a heap buffer prior to decompression. This length is not bounded by the max_cert_list setting, which otherwise constrains certificate message sizes. An attacker can exploit this to cause large per-connection allocations followed by handshake failure. No memory corruption or information disclosure occurs.

This issue only affects builds where TLS 1.3 certificate compression is compiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression algorithm (brotli, zlib, or zstd) is available, and where the compression extension is negotiated. Both clients receiving a server CompressedCertificate and servers in mutual TLS scenarios receiving a client CompressedCertificate are affected. Servers that do not request client certificates are not vulnerable to client-initiated attacks.

Users can mitigate this issue by setting SSL_OP_NO_RX_CERTIFICATE_COMPRESSION to disable receiving compressed certificates.

The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the TLS implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.

OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

Record
ALPINE-CVE-2025-66199
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2025-66199 5.9
Record
BELL-CVE-2025-66199
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 18 moreShow less
OSV 5.9

TLS 1.3 CompressedCertificate excessive memory allocation

Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit.

Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service).

In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate message is used to grow a heap buffer prior to decompression. This length is not bounded by the max_cert_list setting, which otherwise constrains certificate message sizes. An attacker can exploit this to cause large per-connection allocations followed by handshake failure. No memory corruption or information disclosure occurs.

This issue only affects builds where TLS 1.3 certificate compression is compiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression algorithm (brotli, zlib, or zstd) is available, and where the compression extension is negotiated. Both clients receiving a server CompressedCertificate and servers in mutual TLS scenarios receiving a client CompressedCertificate are affected. Servers that do not request client certificates are not vulnerable to client-initiated attacks.

Users can mitigate this issue by setting SSL_OP_NO_RX_CERTIFICATE_COMPRESSION to disable receiving compressed certificates.

The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the TLS implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.

OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

Record
CVE-2025-66199
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-789
Updated
2026-11-02
OSVDEBIAN-CVE-2025-66199 5.9

Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit. Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service). In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate message is used to grow a heap buffer prior to decompression. This length is not bounded by the max_cert_list setting, which otherwise constrains certificate message sizes. An attacker can exploit this to cause large per-connection allocations followed by handshake failure. No memory corruption or information disclosure occurs. This issue only affects builds where TLS 1.3 certificate compression is compiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression algorithm (brotli, zlib, or zstd) is available, and where the compression extension is negotiated. Both clients receiving a server CompressedCertificate and servers in mutual TLS scenarios receiving a client CompressedCertificate are affected. Servers that do not request client certificates are not vulnerable to client-initiated attacks. Users can mitigate this issue by setting SSL_OP_NO_RX_CERTIFICATE_COMPRESSION to disable receiving compressed certificates. The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the TLS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue. OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

Record
DEBIAN-CVE-2025-66199
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2026-260 5.9

Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large...

Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit.

Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service).

In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate message is used to grow a heap buffer prior to decompression. This length is not bounded by the max_cert_list setting, which otherwise constrains certificate message sizes. An attacker can exploit this to cause large per-connection allocations followed by handshake failure. No memory corruption or information disclosure occurs.

This issue only affects builds where TLS 1.3 certificate compression is compiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression algorithm (brotli, zlib, or zstd) is available, and where the compression extension is negotiated. Both clients receiving a server CompressedCertificate and servers in mutual TLS scenarios receiving a client CompressedCertificate are affected. Servers that do not request client certificates are not vulnerable to client-initiated attacks.

Users can mitigate this issue by setting SSL_OP_NO_RX_CERTIFICATE_COMPRESSION to disable receiving compressed certificates.

The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the TLS implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.

OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

Record
JLSEC-2026-260
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:1472 9.8

Red Hat Security Advisory: openssl security update

Record
RHSA-2026:1472
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:1473 9.8

Red Hat Security Advisory: openssl security update

Record
RHSA-2026:1473
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:7261 9.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7261
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:1472 9.8

Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

  • openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file (CVE-2025-11187)

  • openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing (CVE-2025-15467)

  • openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling (CVE-2025-15468)

  • openssl: OpenSSL: Data integrity bypass in openssl dgst command due to silent truncation (CVE-2025-15469)

  • openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression (CVE-2025-66199)

  • openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter (CVE-2025-68160)

  • openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls (CVE-2025-69418)

  • openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing (CVE-2025-69419)

  • openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing (CVE-2025-69421)

  • openssl: OpenSSL: Denial of Service via malformed TimeStamp Response (CVE-2025-69420)

  • openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing (CVE-2026-22795)

  • openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification (CVE-2026-22796)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:1472
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:1473 9.8

Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

  • openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file (CVE-2025-11187)

  • openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing (CVE-2025-15467)

  • openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling (CVE-2025-15468)

  • openssl: OpenSSL: Data integrity bypass in openssl dgst command due to silent truncation (CVE-2025-15469)

  • openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression (CVE-2025-66199)

  • openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter (CVE-2025-68160)

  • openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls (CVE-2025-69418)

  • openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing (CVE-2025-69419)

  • openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing (CVE-2025-69421)

  • openssl: OpenSSL: Denial of Service via malformed TimeStamp Response (CVE-2025-69420)

  • openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing (CVE-2026-22795)

  • openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification (CVE-2026-22796)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:1473
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-66199 5.9

Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit. Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service). In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate message is used to grow a heap buffer prior to decompression. This length is not bounded by the max_cert_list setting, which otherwise constrains certificate message sizes. An attacker can exploit this to cause large per-connection allocations followed by handshake failure. No memory corruption or information disclosure occurs. This issue only affects builds where TLS 1.3 certificate compression is compiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression algorithm (brotli, zlib, or zstd) is available, and where the compression extension is negotiated. Both clients receiving a server CompressedCertificate and servers in mutual TLS scenarios receiving a client CompressedCertificate are affected. Servers that do not request client certificates are not vulnerable to client-initiated attacks. Users can mitigate this issue by setting SSL_OP_NO_RX_CERTIFICATE_COMPRESSION to disable receiving compressed certificates. The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the TLS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue. OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

Record
UBUNTU-CVE-2025-66199
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:1472 No score

Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

  • openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file (CVE-2025-11187)
  • openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing (CVE-2025-15467)
  • openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling (CVE-2025-15468)
  • openssl: OpenSSL: Data integrity bypass in openssl dgst command due to silent truncation (CVE-2025-15469)
  • openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression (CVE-2025-66199)
  • openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter (CVE-2025-68160)
  • openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls (CVE-2025-69418)
  • openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing (CVE-2025-69419)
  • openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing (CVE-2025-69421)
  • openssl: OpenSSL: Denial of Service via malformed TimeStamp Response (CVE-2025-69420)
  • openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing (CVE-2026-22795)
  • openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification (CVE-2026-22796)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:1472
Updated
2026-11-02
OSVALSA-2026:1473 No score

Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

  • openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file (CVE-2025-11187)
  • openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing (CVE-2025-15467)
  • openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling (CVE-2025-15468)
  • openssl: OpenSSL: Data integrity bypass in openssl dgst command due to silent truncation (CVE-2025-15469)
  • openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression (CVE-2025-66199)
  • openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter (CVE-2025-68160)
  • openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls (CVE-2025-69418)
  • openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing (CVE-2025-69419)
  • openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing (CVE-2025-69421)
  • openssl: OpenSSL: Denial of Service via malformed TimeStamp Response (CVE-2025-69420)
  • openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing (CVE-2026-22795)
  • openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification (CVE-2026-22796)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:1473
Updated
2026-11-02
OSVAZL-75284 No score

CVE-2025-66199 affecting package openssl for versions less than 3.3.5-3

Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit.

Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service).

In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate message is used to grow a heap buffer prior to decompression. This length is not bounded by the max_cert_list setting, which otherwise constrains certificate message sizes. An attacker can exploit this to cause large per-connection allocations followed by handshake failure. No memory corruption or information disclosure occurs.

This issue only affects builds where TLS 1.3 certificate compression is compiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression algorithm (brotli, zlib, or zstd) is available, and where the compression extension is negotiated. Both clients receiving a server CompressedCertificate and servers in mutual TLS scenarios receiving a client CompressedCertificate are affected. Servers that do not request client certificates are not vulnerable to client-initiated attacks.

Users can mitigate this issue by setting SSL_OP_NO_RX_CERTIFICATE_COMPRESSION to disable receiving compressed certificates.

The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the TLS implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.

OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

Record
AZL-75284
Updated
2026-11-02
OSVCLSA-2026-1772112014 No score

openssl: Fix of CVE-2025-66199

  • CVE-2025-66199: validate uncompressed certificate length to prevent large pre-decompression allocation
Record
CLSA-2026-1772112014
Updated
2026-11-02
OSVopenSUSE-SU-2026:10237-1 No score

libopenssl-3-devel-3.5.3-2.1 on GA media

These are all security issues fixed in the libopenssl-3-devel-3.5.3-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10237-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20152-1 No score

Security update for openssl-3

This update for openssl-3 fixes the following issues:

Security fixes:

  • CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829).
  • CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).
  • CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831).
  • CVE-2025-15469: "openssl dgst" one-shot codepath silently truncates inputs >16MB (bsc#1256832).
  • CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833).
  • CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).
  • CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).
  • CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).
  • CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).
  • CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).
  • CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).
  • CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).

Other fixes:

  • Enable livepatching support for ppc64le (bsc#1257274).
Record
openSUSE-SU-2026:20152-1
Updated
2026-11-02
OSVSUSE-SU-2026:20211-1 No score

Security update for openssl-3

This update for openssl-3 fixes the following issues:

Security fixes:

  • CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829).
  • CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).
  • CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831).
  • CVE-2025-15469: "openssl dgst" one-shot codepath silently truncates inputs >16MB (bsc#1256832).
  • CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833).
  • CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).
  • CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).
  • CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).
  • CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).
  • CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).
  • CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).
  • CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).

Other fixes:

  • Enable livepatching support for ppc64le (bsc#1257274).
Record
SUSE-SU-2026:20211-1
Updated
2026-11-02
OSVSUSE-SU-2026:20223-1 No score

Security update for openssl-3

This update for openssl-3 fixes the following issues:

Security fixes:

  • CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829).
  • CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).
  • CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831).
  • CVE-2025-15469: "openssl dgst" one-shot codepath silently truncates inputs >16MB (bsc#1256832).
  • CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833).
  • CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).
  • CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).
  • CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).
  • CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).
  • CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).
  • CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).
  • CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).

Other fixes:

  • Enable livepatching support for ppc64le (bsc#1257274).
Record
SUSE-SU-2026:20223-1
Updated
2026-11-02
OSVUSN-7980-1 No score

openssl vulnerabilities

Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL incorrectly validated PBMAC1 parameters when doing PKCS#12 MAC verification. An attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 25.10. (CVE-2025-11187)

Stanislav Fort discovered that OpenSSL incorrectly parsed CMS AuthEnvelopedData messages. An attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2025-15467)

Stanislav Fort discovered that OpenSSL incorrectly handled memory in the SSL_CIPHER_find() function. An attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 25.10. (CVE-2025-15468)

Stanislav Fort discovered that the OpenSSL "openssl dgst" command line tool incorrectly truncated data to 16MB. An attacker could posibly use this issue to hide unauthenticated data beyond the 16MB limit. This issue only affected Ubuntu 25.10. (CVE-2025-15469)

Tomas Dulka and Stanislav Fort discovered that OpenSSL incorrectly handled memory with TLS 1.3 connections using certificate compression. An attacker could possibly use this issue to consume resources, leading to a denial of service. This issue only affected Ubuntu 25.10. (CVE-2025-66199)

Petr Simecek and Stanislav Fort discovered that OpenSSL incorrectly handled memory when writing large data into a BIO chain. An attacker could possibly use this issue to consume resources, leading to a denial of service. (CVE-2025-68160)

Stanislav Fort discovered that the OpenSSL OCB API could incorrectly leave final partial blocks unencrypted and unauthenticated. An attacker could possibly use this issue to read or tamper with the affected final bytes. (CVE-2025-69418)

Stanislav Fort discovered that OpenSSL incorrectly handled the PKCS12_get_friendlyname() utf-8 conversion. An attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2025-69419)

Luigino Camastra discovered that OpenSSL incorrectly handled ASN1_TYPE validation in the TS_RESP_verify_response() function. An attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2025-69420)

Luigino Camastra discovered that OpenSSL incorrectly handled memory in the PKCS12_item_decrypt_d2i_ex function. An attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2025-69421)

Luigino Camastra discovered that OpenSSL incorrectly handled ASN1_TYPE validation in PKCS#12 parsing. An attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2026-22795)

Luigino Camastra discovered that OpenSSL incorrectly handled ASN1_TYPE validation in the PKCS7_digest_from_attributes() function. An attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2026-22796)

Record
USN-7980-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssl
Alpine:v3.20
 3.3.0 up to 3.3.6-r0
3.3.6-r0
openssl
Alpine:v3.21
 3.3.0 up to 3.3.6-r0
3.3.6-r0
openssl
Alpine:v3.22
 3.3.0 up to 3.5.5-r0
3.5.5-r0
openssl
Alpine:v3.23
 3.3.0 up to 3.5.5-r0
3.5.5-r0
openssl
Alpine:v3.24
 3.3.0 up to 3.5.5-r0
3.5.5-r0
openssl
AlmaLinux:10
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el10_1.alma.1
1:3.5.1-7.el10_1.alma.1
openssl-devel
AlmaLinux:10
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el10_1.alma.1
1:3.5.1-7.el10_1.alma.1
openssl-libs
AlmaLinux:10
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el10_1.alma.1
1:3.5.1-7.el10_1.alma.1
openssl-perl
AlmaLinux:10
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el10_1.alma.1
1:3.5.1-7.el10_1.alma.1
openssl
AlmaLinux:9
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el9_7
1:3.5.1-7.el9_7
Show 59 moreShow less
Affected packages
PackageAffectedFixed
openssl-devel
AlmaLinux:9
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el9_7
1:3.5.1-7.el9_7
openssl-libs
AlmaLinux:9
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el9_7
1:3.5.1-7.el9_7
openssl-perl
AlmaLinux:9
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el9_7
1:3.5.1-7.el9_7
openssl
Azure Linux:3
 before 3.3.5-3
3.3.5-3
openssl
Alpaquita:25
 3.5.0-r0 up to 3.5.5-r0
3.5.5-r0
openssl
Alpaquita:stream
 3.1.1-r1 up to 3.5.5-r0
3.5.5-r0
openssl
BellSoft Hardened Containers:25
 3.5.0-r0 up to 3.5.5-r0
3.5.5-r0
openssl
BellSoft Hardened Containers:stream
 3.1.1-r1 up to 3.5.5-r0
3.5.5-r0
openssl
TuxCare:AlmaLinux:9.6
 before 1:3.2.2-6.el9_6.1.tuxcare.6.els6
1:3.2.2-6.el9_6.1.tuxcare.6.els6
openssl-devel
TuxCare:AlmaLinux:9.6
 before 1:3.2.2-6.el9_6.1.tuxcare.6.els6
1:3.2.2-6.el9_6.1.tuxcare.6.els6
openssl-libs
TuxCare:AlmaLinux:9.6
 before 1:3.2.2-6.el9_6.1.tuxcare.6.els6
1:3.2.2-6.el9_6.1.tuxcare.6.els6
openssl-perl
TuxCare:AlmaLinux:9.6
 before 1:3.2.2-6.el9_6.1.tuxcare.6.els6
1:3.2.2-6.el9_6.1.tuxcare.6.els6
openssl
Debian:13
 before 3.5.4-1~deb13u2, plus listed versions
3.5.1-13.5.1-1+deb13u13.5.2-13.5.3-13.5.4-1~deb13u1
3.5.4-1~deb13u2
openssl
Debian:14
 before 3.5.5-1, plus listed versions
3.5.1-13.5.2-13.5.3-13.5.4-13.5.4-1~deb13u13.5.4-1~deb13u23.5.5-1~deb13u13.5.5-1~deb13u2
3.5.5-1
OpenSSL_jll
Julia
 3.5.0+0 up to 3.5.5+0
3.5.5+0
openssl-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el10_1
1:3.5.1-7.el10_1
openssl-debugsource
Red Hat:enterprise_linux:10.1
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el10_1
1:3.5.1-7.el10_1
openssl-devel
Red Hat:enterprise_linux:10.1
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el10_1
1:3.5.1-7.el10_1
openssl-libs-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el10_1
1:3.5.1-7.el10_1
openssl-perl
Red Hat:enterprise_linux:10.1
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el10_1
1:3.5.1-7.el10_1
openssl
Red Hat:enterprise_linux:10.1
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el10_1
1:3.5.1-7.el10_1
openssl-libs
Red Hat:enterprise_linux:10.1
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el10_1
1:3.5.1-7.el10_1
openssl-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el9_7
1:3.5.1-7.el9_7
openssl-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el9_7
1:3.5.1-7.el9_7
openssl-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el9_7
1:3.5.1-7.el9_7
openssl-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el9_7
1:3.5.1-7.el9_7
openssl-perl
Red Hat:enterprise_linux:9::appstream
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el9_7
1:3.5.1-7.el9_7
openssl
Red Hat:enterprise_linux:9::baseos
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el9_7
1:3.5.1-7.el9_7
openssl-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el9_7
1:3.5.1-7.el9_7
openssl-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el9_7
1:3.5.1-7.el9_7
openssl-libs
Red Hat:enterprise_linux:9::baseos
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el9_7
1:3.5.1-7.el9_7
openssl-libs-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el9_7
1:3.5.1-7.el9_7
openssl
Red Hat:hummingbird:1
From an advisory covering 23 CVEs
 before 0:3.5.6-0.1.hum1
0:3.5.6-0.1.hum1
openssl-config-fips
Red Hat:hummingbird:1
From an advisory covering 23 CVEs
 before 0:3.5.6-0.1.hum1
0:3.5.6-0.1.hum1
openssl-devel
Red Hat:hummingbird:1
From an advisory covering 23 CVEs
 before 0:3.5.6-0.1.hum1
0:3.5.6-0.1.hum1
openssl-devel-engine
Red Hat:hummingbird:1
From an advisory covering 23 CVEs
 before 0:3.5.6-0.1.hum1
0:3.5.6-0.1.hum1
openssl-libs
Red Hat:hummingbird:1
From an advisory covering 23 CVEs
 before 0:3.5.6-0.1.hum1
0:3.5.6-0.1.hum1
openssl-perl
Red Hat:hummingbird:1
From an advisory covering 23 CVEs
 before 0:3.5.6-0.1.hum1
0:3.5.6-0.1.hum1
openssl
Rocky Linux:10
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el10_1
1:3.5.1-7.el10_1
openssl
Rocky Linux:9
From an advisory covering 12 CVEs
 before 1:3.5.1-7.el9_7
1:3.5.1-7.el9_7
openssl-3
SUSE:Linux Micro 6.2
From an advisory covering 12 CVEs
 before 3.5.0-160000.5.1
3.5.0-160000.5.1
openssl-3
SUSE:Linux Enterprise Server 16.0
From an advisory covering 12 CVEs
 before 3.5.0-160000.5.1
3.5.0-160000.5.1
openssl-3
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 12 CVEs
 before 3.5.0-160000.5.1
3.5.0-160000.5.1
nodejs
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.10.25~dfsg2-2ubuntu14.2.2~dfsg-14.2.3~dfsg-14.2.4~dfsg-1ubuntu14.2.4~dfsg-2
Show 7 moreShow less
4.2.6~dfsg-1ubuntu14.2.6~dfsg-1ubuntu44.2.6~dfsg-1ubuntu4.14.2.6~dfsg-1ubuntu4.24.2.6~dfsg-1ubuntu4.2+esm14.2.6~dfsg-1ubuntu4.2+esm24.2.6~dfsg-1ubuntu4.2+esm3
 None known
nodejs
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
6.11.4~dfsg-1ubuntu16.11.4~dfsg-1ubuntu26.12.0~dfsg-1ubuntu16.12.0~dfsg-2ubuntu16.12.0~dfsg-2ubuntu2
Show 10 moreShow less
8.10.0~dfsg-28.10.0~dfsg-2ubuntu0.28.10.0~dfsg-2ubuntu0.38.10.0~dfsg-2ubuntu0.48.10.0~dfsg-2ubuntu0.4+esm18.10.0~dfsg-2ubuntu0.4+esm28.10.0~dfsg-2ubuntu0.4+esm38.10.0~dfsg-2ubuntu0.4+esm48.10.0~dfsg-2ubuntu0.4+esm58.10.0~dfsg-2ubuntu0.4+esm6
 None known
nodejs
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
12.22.5~dfsg-5ubuntu112.22.7~dfsg-2ubuntu112.22.7~dfsg-2ubuntu312.22.9~dfsg-1ubuntu212.22.9~dfsg-1ubuntu3
Show 7 moreShow less
12.22.9~dfsg-1ubuntu3.112.22.9~dfsg-1ubuntu3.212.22.9~dfsg-1ubuntu3.312.22.9~dfsg-1ubuntu3.412.22.9~dfsg-1ubuntu3.512.22.9~dfsg-1ubuntu3.612.22.9~dfsg-1ubuntu3.6+esm2
 None known
edk2
Ubuntu:24.04:LTS
 All versions, plus listed versions
2023.05-22023.11-22023.11-32023.11-42023.11-5
Show 13 moreShow less
2023.11-62023.11-82024.02-12024.02-22024.02-2ubuntu0.12024.02-2ubuntu0.32024.02-2ubuntu0.42024.02-2ubuntu0.52024.02-2ubuntu0.62024.02-2ubuntu0.72024.02-2ubuntu0.82024.02-2ubuntu0.92024.02-2ubuntu0.10
 None known
edk2
Ubuntu:25.10
 All versions, plus listed versions
2025.02-3ubuntu22025.02-82025.02-8ubuntu12025.02-8ubuntu22025.02-8ubuntu32025.02-8ubuntu3.12025.02-8ubuntu3.2
 None known
openssl
Ubuntu:25.10
 before 3.5.3-1ubuntu3, plus listed versions
3.4.1-1ubuntu33.5.0-2ubuntu13.5.2-1ubuntu13.5.3-1ubuntu2
3.5.3-1ubuntu3
edk2
Ubuntu:26.10
 All versions, plus listed versions
2025.11-3ubuntu72025.11-3ubuntu82026.05-2ubuntu12026.05-2ubuntu22026.05-2ubuntu3
 None known
edk2-hwe
Ubuntu:26.10
 All versions, plus listed versions
2025.11-3ubuntu82025.11-3ubuntu92026.05-2ubuntu12026.05-2ubuntu22026.05-2ubuntu3
 None known
edk2
Ubuntu:26.04:LTS
 All versions, plus listed versions
2025.02-8ubuntu32025.11-3ubuntu62025.11-3ubuntu72025.11-3ubuntu7.22025.11-3ubuntu7.3
 None known
edk2-hwe
Ubuntu:26.04:LTS
 All versions, plus listed versions
2025.11-3ubuntu62025.11-3ubuntu82025.11-3ubuntu8.2
 None known
openssl
Ubuntu:26.04:LTS
 before 3.5.5-1ubuntu1, plus listed versions
3.5.3-1ubuntu2
3.5.5-1ubuntu1
openssl
Ubuntu:22.04:LTS
From an advisory covering 12 CVEs
 before 3.0.2-0ubuntu1.21, plus listed versions
1.1.1l-1ubuntu13.0.0-1ubuntu13.0.1-0ubuntu13.0.2-0ubuntu13.0.2-0ubuntu1.1
Show 17 moreShow less
3.0.2-0ubuntu1.23.0.2-0ubuntu1.43.0.2-0ubuntu1.53.0.2-0ubuntu1.63.0.2-0ubuntu1.73.0.2-0ubuntu1.83.0.2-0ubuntu1.93.0.2-0ubuntu1.103.0.2-0ubuntu1.123.0.2-0ubuntu1.133.0.2-0ubuntu1.143.0.2-0ubuntu1.153.0.2-0ubuntu1.163.0.2-0ubuntu1.173.0.2-0ubuntu1.183.0.2-0ubuntu1.193.0.2-0ubuntu1.20
3.0.2-0ubuntu1.21
openssl
Ubuntu:24.04:LTS
From an advisory covering 12 CVEs
 before 3.0.13-0ubuntu3.7, plus listed versions
3.0.10-1ubuntu23.0.10-1ubuntu2.13.0.10-1ubuntu33.0.10-1ubuntu43.0.13-0ubuntu2
Show 7 moreShow less
3.0.13-0ubuntu33.0.13-0ubuntu3.13.0.13-0ubuntu3.23.0.13-0ubuntu3.33.0.13-0ubuntu3.43.0.13-0ubuntu3.53.0.13-0ubuntu3.6
3.0.13-0ubuntu3.7
openssl
Ubuntu:25.10
From an advisory covering 12 CVEs
 before 3.5.3-1ubuntu3, plus listed versions
3.4.1-1ubuntu33.5.0-2ubuntu13.5.2-1ubuntu13.5.3-1ubuntu2
3.5.3-1ubuntu3
openssl-3
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 3.5.3-2.1
3.5.3-2.1
openssl-3
openSUSE:Leap 16.0
From an advisory covering 12 CVEs
 before 3.5.0-160000.5.1
3.5.0-160000.5.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-66199 is a medium vulnerability (CVSS 5.9) in Openssl, published January 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in openssl 3.3.6-r0.

References

Show 173 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open