OpenSSL Release Announcement and Security Advisory - 30th Sep 2025
Release Announcement for OpenSSL Library 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.0.2zm and 1.1.1zd
The OpenSSL Project team announces the release of new versions of our open-source toolkit for SSL/TLS.
Changes and CVEs fixed in 3.5.4:
- CVE-2025-9230 - Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap.
- CVE-2025-9231 - Fix Timing side-channel in SM2 algorithm on 64-bit ARM.
- CVE-2025-9232 - Fix Out-of-bounds read in HTTP client no_proxy handling.
- Reverted the synthesised
OPENSSL_VERSION_NUMBER change for the release builds, as it broke some existing applications that relied on the previous 3.x semantics, as documented in OpenSSL_version(3).
CVEs fixed in 3.4.3:
- CVE-2025-9230 - Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap.
- CVE-2025-9231 - Fix Timing side-channel in SM2 algorithm on 64-bit ARM.
- CVE-2025-9232 - Fix Out-of-bounds read in HTTP client no_proxy handling.
CVEs fixed in 3.3.5:
- CVE-2025-9230 - Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap.
- CVE-2025-9231 - Fix Timing side-channel in SM2 algorithm on 64-bit ARM.
- CVE-2025-9232 - Fix Out-of-bounds read in HTTP client no_proxy handling.
CVEs fixed in 3.2.6:
- CVE-2025-9230 - Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap.
- CVE-2025-9231 - Fix Timing side-channel in SM2 algorithm on 64-bit ARM.
- CVE-2025-9232 - Fix Out-of-bounds read in HTTP client no_proxy handling.
CVEs fixed in 3.0.18:
- CVE-2025-9230 - Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap.
- CVE-2025-9232 - Fix Out-of-bounds read in HTTP client no_proxy handling.
CVEs fixed in 1.1.1zd: (premium support customers only)
- CVE-2025-9230 - Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap.
CVEs fixed in 1.0.2zm: (premium support customers only)
- CVE-2025-9230 - Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap.
All releases contain miscellaneous minor bug fixes. For details of the changes, refer to the release notes for versions 1.0.2, 1.1.1, 3.0, 3.2, 3.3, 3.4, and 3.5.
Specific notes on upgrading from previous versions are available in the OpenSSL Migration Guide.
OpenSSL Library 3.x is available for download at these URLs:
The distribution file names are for:
Security Advisory - 30th September 2025
CVE-2025-9230 - Out-of-bounds read & write in RFC 3211 KEK Unwrap
Severity: Moderate
Link for this security advisory: CVE-2025-9230
Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write.
Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code.
Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy.
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
issue, as the CMS implementation is outside the OpenSSL FIPS module
boundary.
OpenSSL 3.5, 3.4, 3.3, 3.2, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.4.
OpenSSL 3.4 users should upgrade to OpenSSL 3.4.3.
OpenSSL 3.3 users should upgrade to OpenSSL 3.3.5.
OpenSSL 3.2 users should upgrade to OpenSSL 3.2.6.
OpenSSL 3.0 users should upgrade to OpenSSL 3.0.18.
OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zd.
(premium support customers only)
OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zm.
(premium support customers only)
This issue was reported on 9th August 2025 by Stanislav Fort (Aisle Research).
The fix was developed by Stanislav Fort (Aisle Research) and Viktor Dukhovni.
CVE-2025-9231 - Timing side-channel in SM2 algorithm on 64 bit ARM
Severity: Moderate
Link for this security advisory: CVE-2025-9231
Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms.
Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.
While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack.
OpenSSL does not directly support certificates with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is possible to add support for such certificates via a custom provider, coupled with the fact that in such a custom provider context the private key may be recoverable via remote timing measurements, we consider this to be a Moderate severity issue.
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
issue, as SM2 is not an approved algorithm.
OpenSSL 3.1, 3.0, 1.1.1 and 1.0.2 are not vulnerable to this issue.
OpenSSL 3.5, 3.4, 3.3, and 3.2 are vulnerable to this issue.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.4.
OpenSSL 3.4 users should upgrade to OpenSSL 3.4.3.
OpenSSL 3.3 users should upgrade to OpenSSL 3.3.5.
OpenSSL 3.2 users should upgrade to OpenSSL 3.2.6.
This issue was reported on 18th August 2025 by Stanislav Fort (Aisle Research)
The fix was developed by Stanislav Fort.
CVE-2025-9232 - Out-of-bounds read in HTTP client no_proxy handling
Severity: Low
Link for this security advisory: CVE-2025-9232
Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the "no_proxy" environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address.
Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application.
The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker.
In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a "no_proxy" environment variable set. For the aforementioned reasons the issue was assessed as Low severity.
The vulnerable code was introduced in the following patch releases:
3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
issue, as the HTTP client implementation is outside the OpenSSL FIPS module
boundary.
OpenSSL 3.5, 3.4, 3.3, 3.2 and 3.0 are vulnerable to this issue.
OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.4.
OpenSSL 3.4 users should upgrade to OpenSSL 3.4.3.
OpenSSL 3.3 users should upgrade to OpenSSL 3.3.5.
OpenSSL 3.2 users should upgrade to OpenSSL 3.2.6.
OpenSSL 3.0 users should upgrade to OpenSSL 3.0.18.
This issue was reported on 16th August 2025 by Stanislav Fort (Aisle Research).
The fix was developed by Stanislav Fort (Aisle Research).
General Advisory Notes
URL for this Security Advisory:
https://openssl-library.org/news/secadv/20250930.txt
Note: the online version of the advisory may be updated with additional details over time.
For details of OpenSSL severity classifications, please see:
https://openssl-library.org/policies/general/security-policy/
