Security Advisories (formerly Vulnerability Notices)

Blog Articles

SA-2026-023 - OpenSSL TimeStamp Response (CVE-2025-69420)

Summary TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed ...

SA-2026-022 - OpenSSL PKCS#12 BMPString Corruption (CVE-2025-69419)

Summary Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write befo...

SA-2026-021 - OpenSSL NULL Pointer DoS (CVE-2025-69421)

Summary Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. A NULL pointer dereference can trigger a crash which leads to Denial of...