CVE-2025-9232
Sept. 30, 2025, 8:15 p.m.
5.9
Medium
Description
Issue summary: An application using the OpenSSL HTTP client API functions may
trigger an out-of-bounds read if the 'no_proxy' environment variable is set and
the host portion of the authority component of the HTTP URL is an IPv6 address.
Impact summary: An out-of-bounds read can trigger a crash which leads to
Denial of Service for an application.
The OpenSSL HTTP client API functions can be used directly by applications
but they are also used by the OCSP client functions and CMP (Certificate
Management Protocol) client implementation in OpenSSL. However the URLs used
by these implementations are unlikely to be controlled by an attacker.
In this vulnerable code the out of bounds read can only trigger a crash.
Furthermore the vulnerability requires an attacker-controlled URL to be
passed from an application to the OpenSSL function and the user has to have
a 'no_proxy' environment variable set. For the aforementioned reasons the
issue was assessed as Low severity.
The vulnerable code was introduced in the following patch releases:
3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
issue, as the HTTP client implementation is outside the OpenSSL FIPS module
boundary.
Product(s) Impacted
| Vendor | Product | Versions |
|---|---|---|
| Openssl |
|
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-125
Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
*CPE(s)
Affected systems and software identified for this CVE.
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| a | openssl | openssl | 3.0.16 | / | / | / | / | / | / | / |
| a | openssl | openssl | 3.1.8 | / | / | / | / | / | / | / |
| a | openssl | openssl | 3.2.4 | / | / | / | / | / | / | / |
| a | openssl | openssl | 3.3.3 | / | / | / | / | / | / | / |
| a | openssl | openssl | 3.4.0 | / | / | / | / | / | / | / |
| a | openssl | openssl | 3.5.0 | / | / | / | / | / | / | / |
References
Tags
CVSS Score
CVSS Data - 3.1
- Attack Vector: NETWORK
- Attack Complexity: HIGH
- Privileges Required: NONE
- Scope: UNCHANGED
- Confidentiality Impact: NONE
- Integrity Impact: NONE
- Availability Impact: HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Timeline
Published: Sept. 30, 2025, 2:15 p.m.
Last Modified: Sept. 30, 2025, 8:15 p.m.
Last Modified: Sept. 30, 2025, 8:15 p.m.
Status : Received
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
openssl-security@openssl.org
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.