FAIL › dossier
OpenSSL
VENDOR· dossier confidence 50%
OpenSSL is a foundational open-source cryptographic library with a documented history of critical vulnerabilities, including high-severity Heartbeat Extension mishandling and critical OCTET STRING conversion issues, posing significant risks to secure communications.
PROFILE
Categoryopen-source cryptographic libraryWhat they doOpenSSL is a widely used open-source toolkit providing SSL/TLS encryption for secure communications.
SECURITY POSTURE
OpenSSL has a history of critical vulnerabilities, including high-severity Heartbeat Extension mishandling and critical OCTET STRING conversion issues, indicating systemic flaws in cryptographic protocol implementation and input validation.
Notable failures
- CVE-2014-0160 Heartbeat Extension mishandling
- CVE-2026-31789 OCTET STRING conversion overflow
Patterns: critical cryptographic protocol implementation flaws; input validation failures in cryptographic extensions
FAILURE HISTORY · 8
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2022-05-04 | CVE-2014-0160 | high | OpenSSL's mishandling of Heartbeat Extension packets allowed remote attackers to extract sensitive data from TLS/DTLS connections. |
| 2022-05-04 | CVE-2014-0160 | high | OpenSSL's mishandling of Heartbeat Extension packets allowed remote attackers to extract sensitive data from TLS/DTLS connections. |
| 2026-04-07 | CVE-2026-31789 | critical | CVE-2026-31789: Issue summary: Converting an excessively large OCTET STRING value to a hexadecim |
| 2026-04-07 | CVE-2026-31789 | critical | CVE-2026-31789: Issue summary: Converting an excessively large OCTET STRING value to a hexadecim |
| 2022-07-01 | CVE-2022-2274 | critical | CVE-2022-2274: The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for |
| 2022-07-01 | CVE-2022-2274 | critical | CVE-2022-2274: The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for |
| 2021-08-24 | CVE-2021-3711 | critical | CVE-2021-3711: In order to decrypt SM2 encrypted data an application is expected to call the AP |
| 2021-08-24 | CVE-2021-3711 | critical | CVE-2021-3711: In order to decrypt SM2 encrypted data an application is expected to call the AP |
Open questions: Current patch status for CVE-2026-31789 · Impact assessment of CVE-2014-0160 on legacy systems
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-15 04:38:54.070501+00:00