Software-update: OpenSSL 3.6.1 / 3.5.5 / 3.4.4 / 3.3.6 / 3.0.19 / 1.1.1ze / 1.0.2zn

OpenSSL is een bekend beveiligingsprogramma dat encryptiefuncties aanbiedt. Het bevat een implementatie van de tls- en ssl-protocollen, waarmee data versleuteld kan worden verstuurd en ontvangen. Voor meer informatie verwijzen we naar deze pagina. De ontwikkelaars hebben updates uitgebracht voor versies 3.6, 3.5, 3.3, 3.0, 1.1 en 1.0, waarin diverse beveiligingsproblemen zijn verholpen.

OpenSSL Release Announcement

The OpenSSL Project team announces the release of new versions of our open-source toolkit for SSL/TLS.

Changes and CVEs fixed in 3.6.1:

• CVE-2025-11187 - Improper validation of PBMAC1 parameters in PKCS#12 MAC verification.
• CVE-2025-15467 - Stack buffer overflow in CMS AuthEnvelopedData parsing.
• CVE-2025-15468 - NULL dereference in SSL_CIPHER_find() function on unknown cipher ID.
• CVE-2025-15469 - ‘openssl dgst’ one-shot codepath silently truncates inputs >16MB.
• CVE-2025-66199 - TLS 1.3 CompressedCertificate excessive memory allocation.
• CVE-2025-68160 - Heap out-of-bounds write in BIO_f_linebuffer on short writes.
• CVE-2025-69418 - Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
• CVE-2025-69419 - Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion.
• CVE-2025-69420 - Missing ASN1_TYPE validation in TS_RESP_verify_response() function.
• CVE-2025-69421 - NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
• CVE-2026-22795 - Missing ASN1_TYPE validation in PKCS#12 parsing
• CVE-2026-22796 - ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function

Changes and CVEs fixed in 3.5.5:

• CVE-2025-11187 - Improper validation of PBMAC1 parameters in PKCS#12 MAC verification.
• CVE-2025-15467 - Stack buffer overflow in CMS AuthEnvelopedData parsing.
• CVE-2025-15468 - NULL dereference in SSL_CIPHER_find() function on unknown cipher ID.
• CVE-2025-15469 - ‘openssl dgst’ one-shot codepath silently truncates inputs >16MB.
• CVE-2025-66199 - TLS 1.3 CompressedCertificate excessive memory allocation.
• CVE-2025-68160 - Heap out-of-bounds write in BIO_f_linebuffer on short writes.
• CVE-2025-69418 - Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
• CVE-2025-69419 - Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion.
• CVE-2025-69420 - Missing ASN1_TYPE validation in TS_RESP_verify_response() function.
• CVE-2025-69421 - NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
• CVE-2026-22795 - Missing ASN1_TYPE validation in PKCS#12 parsing
• CVE-2026-22796 - ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function

CVEs fixed in 3.4.4:

• CVE-2025-11187 - Improper validation of PBMAC1 parameters in PKCS#12 MAC verification.
• CVE-2025-15467 - Stack buffer overflow in CMS AuthEnvelopedData parsing.
• CVE-2025-15468 - NULL dereference in SSL_CIPHER_find() function on unknown cipher ID.
• CVE-2025-66199 - TLS 1.3 CompressedCertificate excessive memory allocation.
• CVE-2025-68160 - Heap out-of-bounds write in BIO_f_linebuffer on short writes.
• CVE-2025-69418 - Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
• CVE-2025-69419 - Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion.
• CVE-2025-69420 - Missing ASN1_TYPE validation in TS_RESP_verify_response() function.
• CVE-2025-69421 - NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
• CVE-2026-22795 - Missing ASN1_TYPE validation in PKCS#12 parsing
• CVE-2026-22796 - ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function

CVEs fixed in 3.3.6:

• CVE-2025-15467 - Stack buffer overflow in CMS AuthEnvelopedData parsing.
• CVE-2025-15468 - NULL dereference in SSL_CIPHER_find() function on unknown cipher ID.
• CVE-2025-66199 - TLS 1.3 CompressedCertificate excessive memory allocation.
• CVE-2025-68160 - Heap out-of-bounds write in BIO_f_linebuffer on short writes.
• CVE-2025-69418 - Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
• CVE-2025-69419 - Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion.
• CVE-2025-69420 - Missing ASN1_TYPE validation in TS_RESP_verify_response() function.
• CVE-2025-69421 - NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
• CVE-2026-22795 - Missing ASN1_TYPE validation in PKCS#12 parsing
• CVE-2026-22796 - ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function

CVEs fixed in 3.0.19:

• CVE-2025-15467 - Stack buffer overflow in CMS AuthEnvelopedData parsing.
• CVE-2025-68160 - Heap out-of-bounds write in BIO_f_linebuffer on short writes.
• CVE-2025-69418 - Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
• CVE-2025-69419 - Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion.
• CVE-2025-69420 - Missing ASN1_TYPE validation in TS_RESP_verify_response() function.
• CVE-2025-69421 - NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
• CVE-2026-22795 - Missing ASN1_TYPE validation in PKCS#12 parsing
• CVE-2026-22796 - ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function

CVEs fixed in 1.1.1ze: (premium support customers only)

• CVE-2025-68160 - Heap out-of-bounds write in BIO_f_linebuffer on short writes.
• CVE-2025-69418 - Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
• CVE-2025-69419 - Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion.
• CVE-2025-69420 - Missing ASN1_TYPE validation in TS_RESP_verify_response() function.
• CVE-2025-69421 - NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
• CVE-2026-22795 - Missing ASN1_TYPE validation in PKCS#12 parsing
• CVE-2026-22796 - ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function

CVEs fixed in 1.0.2zn: (premium support customers only)

• CVE-2025-68160 - Heap out-of-bounds write in BIO_f_linebuffer on short writes.
• CVE-2025-69421 - NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
• CVE-2026-22796 - ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function

Versienummer	3.6.1 / 3.5.5 / 3.4.4 / 3.3.6
Releasestatus	Final
Besturingssystemen	Android, Linux, BSD, macOS, Solaris, iOS, Windows 10, Windows Server 2016, Windows Server 2019, Windows 11, Windows Server 2022, Windows Server 2025
Website	OpenSSL
Download	https://openssl-library.org/source/
Licentietype	Voorwaarden (GNU/BSD/etc.)

Reacties (3)

[rubenvb]

Fun fact: deze vulnerabilities werden door een AI tool gevonden:
https://hackingpassion.com/openssl-12-cves-ai-january-2026/

[elmuerte]

Less fun fact: dit waren alleen de legitieme vulnerability reports, wat niet bekend is is hoeveel false positives AISLE geproduceerd heeft, welke daarvan ook naar OpenSSL gestuurd zijn. De bug reports zijn wel gecontrolleerd door mensen van AISLE voordat ze naar OpenSSL gingen. (Want anders is het slechte reclame for hun product)

Post van een AISLE'er: https://www.lesswrong.com/posts/7aJwgbMEiKq5egQbd/ai-found-12-of-12-openssl-zero-days-while-curl-cancelled-its (maar die gaat natuurlijk niet in op de slop)

Reactie van een veelvoudige cURL security issue researcher: https://idlethumbs.social/@[e-mail]/115973145272797533

[Reactie gewijzigd door elmuerte op 30 januari 2026 17:47]

[Jeoh]

"We appreciate the high quality of the reports and their constructive collaboration with us throughout the remediation"

Dat klinkt al een stuk beter dan de meeste AI-generated 'vulnerabilities' waarmee de meeste projecten kapotgespamd worden.