Is openssl-src safe to use? Its security history

Every advisory, newest first

• VulnerabilityRUSTSEC-2023-0006 · 2023-02-07X.400 address type confusion in X.509 `GeneralName`
• VulnerabilityRUSTSEC-2023-0007 · 2023-02-07Timing Oracle in RSA Decryption
• VulnerabilityRUSTSEC-2023-0008 · 2023-02-07X.509 Name Constraints Read Buffer Overflow
• VulnerabilityRUSTSEC-2023-0009 · 2023-02-07Use-after-free following `BIO_new_NDEF`
• VulnerabilityRUSTSEC-2023-0010 · 2023-02-07Double free after calling `PEM_read_bio_ex`
• VulnerabilityRUSTSEC-2023-0011 · 2023-02-07Invalid pointer dereference in `d2i_PKCS7` functions
• VulnerabilityRUSTSEC-2023-0012 · 2023-02-07`NULL` dereference validating DSA public key
• VulnerabilityRUSTSEC-2023-0013 · 2023-02-07`NULL` dereference during PKCS7 data verification
• VulnerabilityGHSA-vr8j-hgmm-jh9r · 2022-12-13Denial of service by double-checked locking in openssl-src
• VulnerabilityRUSTSEC-2022-0064 · 2022-11-01X.509 Email Address 4-byte Buffer Overflow
• VulnerabilityRUSTSEC-2022-0065 · 2022-11-01X.509 Email Address Variable Length Buffer Overflow
• VulnerabilityRUSTSEC-2022-0059 · 2022-10-11Using a Custom Cipher with `NID_undef` may lead to NULL encryption
• VulnerabilityRUSTSEC-2022-0032 · 2022-07-05AES OCB fails to encrypt some bytes
• VulnerabilityRUSTSEC-2022-0033 · 2022-07-05Heap memory corruption with RSA private key operation
• Vulnerability HighRUSTSEC-2022-0025 · 2022-05-03Resource leakage when decoding certificates and keys
• Vulnerability MediumRUSTSEC-2022-0026 · 2022-05-03Incorrect MAC key used in the RC4-MD5 ciphersuite
• Vulnerability MediumRUSTSEC-2022-0027 · 2022-05-03`OCSP_basic_verify` may incorrectly verify the response signing certificate
• VulnerabilityRUSTSEC-2022-0014 · 2022-03-15Infinite loop in `BN_mod_sqrt()` reachable when parsing certificates
• VulnerabilityRUSTSEC-2021-0129 · 2021-12-14Invalid handling of `X509_verify_cert()` internal errors in libssl
• Vulnerability CriticalRUSTSEC-2021-0097 · 2021-08-24SM2 Decryption Buffer Overflow
• Vulnerability HighRUSTSEC-2021-0098 · 2021-08-24Read buffer overruns processing ASN.1 strings
• Vulnerability MediumRUSTSEC-2021-0055 · 2021-05-01NULL pointer deref in signature_algorithms processing
• Vulnerability HighRUSTSEC-2021-0056 · 2021-05-01CA certificate check bypass with X509_V_FLAG_X509_STRICT
• Vulnerability HighRUSTSEC-2021-0057 · 2021-05-01Integer overflow in CipherUpdate
• Vulnerability MediumRUSTSEC-2021-0058 · 2021-05-01Null pointer deref in `X509_issuer_and_serial_hash()`
• Vulnerability HighRUSTSEC-2020-0015 · 2020-04-25Crash causing Denial of Service attack

Check your version

Run cargo tree -i openssl-src to see which version you build and why, or paste your Cargo.lock into the Cargo.toml checker to match every advisory against your exact versions.

Download trends, dependents and alternatives: openssl-src crate data.

RustSec advisories (CC0-1.0) and GitHub-reviewed advisories via OSV's crates.io export, downloaded Oct 24, 2026.