OpenSSL up to 3.0.17/3.2.5/3.3.4/3.4.2/3.5.3 HTTP Client API out-of-bounds

Summaryinfo

A vulnerability classified as problematic was found in OpenSSL up to 3.0.17/3.2.5/3.3.4/3.4.2/3.5.3. This issue affects some unknown processing of the component HTTP Client API. Such manipulation leads to out-of-bounds. This vulnerability is documented as CVE-2025-9232. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in OpenSSL up to 3.0.17/3.2.5/3.3.4/3.4.2/3.5.3. Affected by this issue is an unknown function of the component HTTP Client API. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is availability. CVE summarizes:

Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.

The advisory is shared for download at openssl-library.org. This vulnerability is handled as CVE-2025-9232 since 08/20/2025. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 02/24/2026).

The vulnerability scanner Nessus provides a plugin with the ID 266357 (Debian dsa-6015 : libcrypto3-udeb - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.0.18, 3.2.6, 3.3.5, 3.4.3 or 3.5.4 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (266357), EUVD (EUVD-2025-31727) and CERT Bund (WID-SEC-2025-2166). Once again VulDB remains the best source for vulnerability data.

Affected

• IBM VIOS
• IBM AIX
• Debian Linux
• Amazon Linux 2
• FreeBSD Project FreeBSD OS
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• IBM App Connect Enterprise
• IBM MQ
• F5 BIG-IP
• IGEL OS
• Open Source OpenSSL
• Open Source LibreSSL
• Dell Secure Connect Gateway
• IBM DevOps Code ClearCase
• Meinberg LANTIME
• Splunk Splunk Enterprise
• SolarWinds Platform

Productinfo

Type

• Network Encryption Software

Name

• OpenSSL

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.0.13
• 3.0.14
• 3.0.15
• 3.0.16
• 3.0.17
• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.4.0
• 3.4.1
• 3.4.2
• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3

License

• open-source

Website

• Product: https://www.openssl.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion