CVE-2025-15468
published 2026-01-27CVE-2025-15468: Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a…
PriorityP431medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
0.75%
50.7th percentile
Issue summary: If an application using the SSL_CIPHER_find() function in
a QUIC protocol client or server receives an unknown cipher suite from
the peer, a NULL dereference occurs.
Impact summary: A NULL pointer dereference leads to abnormal termination of
the running process causing Denial of Service.
Some applications call SSL_CIPHER_find() from the client_hello_cb callback
on the cipher ID received from the peer. If this is done with an SSL object
implementing the QUIC protocol, NULL pointer dereference will happen if
the examined cipher ID is unknown or unsupported.
As it is not very common to call this function in applications using the QUIC
protocol and the worst outcome is Denial of Service, the issue was assessed
as Low severity.
The vulnerable code was introduced in the 3.2 version with the addition
of the QUIC protocol support.
The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,
as the QUIC implementation is outside the OpenSSL FIPS module boundary.
OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.
OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openssl | < openssl 3.5.5-1 (forky) | openssl 3.5.5-1 (forky) |
| openssl | openssl | >= 0 < 3.3.6-r0 | 3.3.6-r0 |
| openssl | openssl | >= 0 < 3.3.6-r0 | 3.3.6-r0 |
| openssl | openssl | >= 0 < 3.5.5-r0 | 3.5.5-r0 |
| openssl | openssl | >= 0 < 3.5.5-r0 | 3.5.5-r0 |
| openssl | openssl | >= 0 < 3.5.4-1~deb13u2 | 3.5.4-1~deb13u2 |
| openssl | openssl | >= 0 < 3.5.5-1 | 3.5.5-1 |
| openssl | openssl | >= 0 < 3.0.2-0ubuntu1.21 | 3.0.2-0ubuntu1.21 |
| openssl | openssl | >= 0 < 3.0.13-0ubuntu3.7 | 3.0.13-0ubuntu3.7 |
| openssl | openssl | >= 0 < 3.5.3-1ubuntu3 | 3.5.3-1ubuntu3 |
| openssl | openssl | >= 0 < 1.0.1f-1ubuntu2.27+esm12 | 1.0.1f-1ubuntu2.27+esm12 |
| openssl | openssl | >= 0 < 1.0.2g-1ubuntu4.20+esm14 | 1.0.2g-1ubuntu4.20+esm14 |
| openssl | openssl | >= 0 < 1.1.1-1ubuntu2.1~18.04.23+esm7 | 1.1.1-1ubuntu2.1~18.04.23+esm7 |
| openssl | openssl | >= 0 < 1.1.1f-1ubuntu2.24+esm2 | 1.1.1f-1ubuntu2.24+esm2 |
| openssl | openssl | >= 3.3.0 < 3.3.6 | 3.3.6 |
| openssl | openssl | >= 3.4.0 < 3.4.4 | 3.4.4 |
| openssl | openssl | >= 3.5.0 < 3.5.5 | 3.5.5 |
| openssl | openssl | >= 3.6.0 < 3.6.1 | 3.6.1 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
osv6.1MEDIUM
vendor_ubuntu6.1MEDIUM
vendor_debian5.9LOW
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rhx3-fg8p-f9m4: Issue summary: If an application using the SSL_CIPHER_find() function in
a QUIC protocol client or server receives an unknown cipher suite from
the pe
ghsa_unreviewed·2026-01-27
CVE-2025-15468 [MEDIUM] CWE-476 GHSA-rhx3-fg8p-f9m4: Issue summary: If an application using the SSL_CIPHER_find() function in
a QUIC protocol client or server receives an unknown cipher suite from
the pe
Issue summary: If an application using the SSL_CIPHER_find() function in
a QUIC protocol client or server receives an unknown cipher suite from
the peer, a NULL dereference occurs.
Impact summary: A NULL pointer dereference leads to abnormal termination of
the running process causing Denial of Service.
Some applications call SSL_CIPHER_find() from the client_hello_cb callback
on the cipher ID received from the peer. If this is done with an SSL object
implementing the QUIC protocol, NULL pointer dereference will happen if
the examined cipher ID is unknown or unsupported.
As it is not very common to call this function in applications using the QUIC
protocol and the worst outcome is Denial of Service, the issue was assessed
as Low severity.
The vulnerable code was introduced in the 3.2 ve
OSV
openssl, openssl1.0 vulnerabilities
osv·2026-01-27·CVSS 6.1
CVE-2025-68160 [MEDIUM] openssl, openssl1.0 vulnerabilities
openssl, openssl1.0 vulnerabilities
USN-7980-2 fixed vulnerabilities in OpenSSL. This update provides the
corresponding updates for CVE-2025-68160 for openssl and openssl1.0,
CVE-2025-69418 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69419 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69420 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69421 for openssl and openssl1.0, CVE-2026-22795 for openssl on
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS, and CVE-2026-22796 for openssl and
openssl1.0.
Original advisory details:
Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL
incorrectly validated PBMAC1 parameters when doing PKCS#12 MAC
verification. An attacker could possibly use this issue to cause OpenSSL
to crash, resulting in a deni
OSV
CVE-2025-15468: Issue summary: If an application using the SSL_CIPHER_find() function in
a QUIC protocol client or server receives an unknown cipher suite from
the pe
osv·2026-01-27·CVSS 5.9
CVE-2025-15468 [MEDIUM] CVE-2025-15468: Issue summary: If an application using the SSL_CIPHER_find() function in
a QUIC protocol client or server receives an unknown cipher suite from
the pe
Issue summary: If an application using the SSL_CIPHER_find() function in
a QUIC protocol client or server receives an unknown cipher suite from
the peer, a NULL dereference occurs.
Impact summary: A NULL pointer dereference leads to abnormal termination of
the running process causing Denial of Service.
Some applications call SSL_CIPHER_find() from the client_hello_cb callback
on the cipher ID received from the peer. If this is done with an SSL object
implementing the QUIC protocol, NULL pointer dereference will happen if
the examined cipher ID is unknown or unsupported.
As it is not very common to call this function in applications using the QUIC
protocol and the worst outcome is Denial of Service, the issue was assessed
as Low severity.
The vulnerable code was introduced in the 3.2 ve
OSV
openssl vulnerabilities
osv·2026-01-27·CVSS 6.1
CVE-2025-11187 [MEDIUM] openssl vulnerabilities
openssl vulnerabilities
Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL
incorrectly validated PBMAC1 parameters when doing PKCS#12 MAC
verification. An attacker could possibly use this issue to cause OpenSSL to
crash, resulting in a denial of service. This issue only affected Ubuntu
25.10. (CVE-2025-11187)
Stanislav Fort discovered that OpenSSL incorrectly parsed CMS
AuthEnvelopedData messages. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service. (CVE-2025-15467)
Stanislav Fort discovered that OpenSSL incorrectly handled memory in the
SSL_CIPHER_find() function. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service. This issue only
affected Ubuntu 25.10. (CVE-2025-15468)
St
OSV
CVE-2025-15468: Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the pe
osv·2026-01-27·CVSS 5.9
CVE-2025-15468 [MEDIUM] CVE-2025-15468: Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the pe
Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of the running process causing Denial of Service. Some applications call SSL_CIPHER_find() from the client_hello_cb callback on the cipher ID received from the peer. If this is done with an SSL object implementing the QUIC protocol, NULL pointer dereference will happen if the examined cipher ID is unknown or unsupported. As it is not very common to call this function in applications using the QUIC protocol and the worst outcome is Denial of Service, the issue was assessed as Low severity. The vulnerable code was introduced in the 3.2 versio
Ubuntu
OpenSSL vulnerabilities
vendor_ubuntu·2026-01-27·CVSS 6.1
CVE-2025-69419 [MEDIUM] OpenSSL vulnerabilities
Title: OpenSSL vulnerabilities
Summary: Several security issues were fixed in OpenSSL.
USN-7980-1 fixed vulnerabilities in OpenSSL. This update provides the
corresponding updates for CVE-2025-68160 for openssl and openssl1.0,
CVE-2025-69418 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69419 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69420 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69421 for openssl and openssl1.0, CVE-2026-22795 for openssl on
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS, and CVE-2026-22796 for openssl and
openssl1.0.
Original advisory details:
Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL
incorrectly validated PBMAC1 parameters when doing PKCS#12 MAC
verification. An attacker could possibly use this
BSD
FreeBSD-SA-26:01.openssl: Multiple vulnerabilities in OpenSSL
bsd_advisories·2026-01-27·CVSS 6.1
CVE-2025-11187 [MEDIUM] FreeBSD-SA-26:01.openssl: Multiple vulnerabilities in OpenSSL
FreeBSD-SA-26:01.openssl Security Advisory
The FreeBSD Project
Topic: Multiple vulnerabilities in OpenSSL
Category: contrib
Module: openssl
Announced: 2026-01-27
Credits: Aisle Research
Affects: All supported versions of FreeBSD.
Corrected: 2026-01-27 19:14:58 UTC (stable/15, 15.0-STABLE)
2026-01-27 19:15:49 UTC (releng/15.0, 15.0-RELEASE-p2)
2026-01-27 19:15:10 UTC (stable/14, 14.3-STABLE)
2026-01-27 19:16:22 UTC (releng/14.3, 14.3-RELEASE-p8)
2026-01-27 19:15:19 UTC (stable/13, 13.4-STABLE)
2026-01-27 19:16:45 UTC (releng/13.5, 13.5-RELEASE-p9)
CVE Name: CVE-2025-11187, CVE-2025-15467, CVE-2025-15468,
CVE-2025-15469, CVE-2025-66199, CVE-2025-68160,
CVE-2025-69418, CVE-2025-69419, CVE-2025-69420,
CVE-2025-69421, CVE-2026-22795, CVE-2026-22796
For general information regarding FreeBSD S
Red Hat
openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling
vendor_redhat·2026-01-27·CVSS 5.9
CVE-2025-15468 [MEDIUM] CWE-476 openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling
openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling
Issue summary: If an application using the SSL_CIPHER_find() function in
a QUIC protocol client or server receives an unknown cipher suite from
the peer, a NULL dereference occurs.
Impact summary: A NULL pointer dereference leads to abnormal termination of
the running process causing Denial of Service.
Some applications call SSL_CIPHER_find() from the client_hello_cb callback
on the cipher ID received from the peer. If this is done with an SSL object
implementing the QUIC protocol, NULL pointer dereference will happen if
the examined cipher ID is unknown or unsupported.
As it is not very common to call this function in applications using the QUIC
protocol and the worst outcome is Denial of Service,
Ubuntu
OpenSSL vulnerabilities
vendor_ubuntu·2026-01-27·CVSS 6.1
CVE-2025-66199 [MEDIUM] OpenSSL vulnerabilities
Title: OpenSSL vulnerabilities
Summary: Several security issues were fixed in OpenSSL.
Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL
incorrectly validated PBMAC1 parameters when doing PKCS#12 MAC
verification. An attacker could possibly use this issue to cause OpenSSL to
crash, resulting in a denial of service. This issue only affected Ubuntu
25.10. (CVE-2025-11187)
Stanislav Fort discovered that OpenSSL incorrectly parsed CMS
AuthEnvelopedData messages. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service. (CVE-2025-15467)
Stanislav Fort discovered that OpenSSL incorrectly handled memory in the
SSL_CIPHER_find() function. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of serv
Debian
CVE-2025-15468: openssl - Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC ...
vendor_debian·2025·CVSS 5.9
CVE-2025-15468 [MEDIUM] CVE-2025-15468: openssl - Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC ...
Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of the running process causing Denial of Service. Some applications call SSL_CIPHER_find() from the client_hello_cb callback on the cipher ID received from the peer. If this is done with an SSL object implementing the QUIC protocol, NULL pointer dereference will happen if the examined cipher ID is unknown or unsupported. As it is not very common to call this function in applications using the QUIC protocol and the worst outcome is Denial of Service, the issue was assessed as Low severity. The vulnerable code was introduced in the 3.2 versio
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-15468 openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling
bugzilla·2026-01-16·CVSS 5.9
CVE-2025-15468 [MEDIUM] CVE-2025-15468 openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling
CVE-2025-15468 openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling
A NULL pointer dereference leads to abnormal termination of
the running process causing Denial of Service.
Some applications call SSL_CIPHER_find() from the client_hello_cb callback
on the cipher ID received from the peer. If this is done with an SSL object
implementing the QUIC protocol, NULL pointer dereference will happen if
the examined cipher ID is unknown or unsupported.
As it is not very common to call this function in applications using the QUIC
protocol and the worst outcome is Denial of Service, the issue was assessed
as Low severity.
The vulnerable code was introduced in the 3.2 version with the addition
of the QUIC protocol support.
The FIPS modules in 3.6, 3.5, 3.4 an
Wiz
CVE-2025-15468 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2025-15468 [MEDIUM] CVE-2025-15468 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-15468 :
OpenSSL vulnerability analysis and mitigation
Issue summary: If an application using the SSL_CIPHER_find() function in
a QUIC protocol client or server receives an unknown cipher suite from
the peer, a NULL dereference occurs.
Impact summary: A NULL pointer dereference leads to abnormal termination of
the running process causing Denial of Service.
Some applications call SSL_CIPHER_find() from the client_hello_cb callback
on the cipher ID received from the peer. If this is done with an SSL object
implementing the QUIC protocol, NULL pointer dereference will happen if
the examined cipher ID is unknown or unsupported.
As it is not very common to call this function in applications using the QUIC
protocol and the worst outcome is Denial of Service, the issue was assesse
https://github.com/openssl/openssl/commit/1f08e54bad32843044fe8a675948d65e3b4ece65https://github.com/openssl/openssl/commit/7c88376731c589ee5b36116c5a6e32d5ae5f7ae2https://github.com/openssl/openssl/commit/b2539639400288a4580fe2d76247541b976bade4https://github.com/openssl/openssl/commit/d75b309879631d45b972396ce4e5102559c64ac7https://openssl-library.org/news/secadv/20260127.txt
2026-01-27
Published