Is openssl safe to use? Its security history

Every advisory, newest first

• VulnerabilityGHSA-phqj-4mhp-q6mq · 2026-05-19rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers
• VulnerabilityGHSA-xv59-967r-8726 · 2026-05-07rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding
• VulnerabilityGHSA-xp3w-r5p5-63rr · 2026-05-05rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs
• VulnerabilityGHSA-pqf5-4pqq-29f5 · 2026-04-22rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1
• VulnerabilityGHSA-xmgf-hq76-4vx2 · 2026-04-22rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length
• VulnerabilityGHSA-8c75-8mhr-p7r9 · 2026-04-22rust-openssl has incorrect bounds assertion in aes key wrap
• VulnerabilityGHSA-ghm9-cr32-g9qj · 2026-04-22rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check
• VulnerabilityGHSA-hppc-g8h3-xhp3 · 2026-04-22rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer
• VulnerabilityRUSTSEC-2025-0022 · 2025-04-04Use-After-Free in `Md::fetch` and `Cipher::fetch`
• VulnerabilityRUSTSEC-2025-0004 · 2025-02-02ssl::select_next_proto use after free
• VulnerabilityRUSTSEC-2024-0357 · 2024-07-21`MemBio::get_buf` has undefined behavior with empty buffers
• UnsoundRUSTSEC-2023-0072 · 2023-11-23`openssl` `X509StoreRef::objects` is unsound
• VulnerabilityRUSTSEC-2023-0044 · 2023-06-20`openssl` `X509VerifyParamRef::set_host` buffer over-read
• VulnerabilityRUSTSEC-2023-0022 · 2023-03-24`openssl` `X509NameBuilder::build` returned object is not thread safe
• VulnerabilityRUSTSEC-2023-0023 · 2023-03-24`openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read
• VulnerabilityRUSTSEC-2023-0024 · 2023-03-24`openssl` `X509Extension::new` and `X509Extension::new_nid` null pointer dereference
• Vulnerability CriticalRUSTSEC-2018-0010 · 2018-06-01Use after free in CMS Signing
• Vulnerability HighRUSTSEC-2016-0001 · 2016-11-05SSL/TLS MitM vulnerability due to insecure defaults

Check your version

Run cargo tree -i openssl to see which version you build and why, or paste your Cargo.lock into the Cargo.toml checker to match every advisory against your exact versions.

Download trends, dependents and alternatives: openssl crate data.

RustSec advisories (CC0-1.0) and GitHub-reviewed advisories via OSV's crates.io export, downloaded Oct 24, 2026.