CVE-2025-9232
- Source
- https://cve.org/CVERecord?id=CVE-2025-9232
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9232.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-9232
- Downstream
ALPINE (1)
BELL (1)
CGA (16)
DEBIAN (1)
ECHO (1)
JLSEC (1)
MGASA (1)
RHSA (1)
UBUNTU (1)
- Related
- Published
- 2025-09-30T13:17:19Z
- Modified
- 2026-11-11T13:19:32Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Out-of-bounds read in HTTP client no_proxy handling
- Details
-
Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address.
Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application.
The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker.
In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity.
The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.
- Database specific
{ "cna_assigner": "openssl", "cwe_ids": [ "CWE-125" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9232.json" }- References
-
- http://www.openwall.com/lists/oss-security/2025/09/30/5
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-089022.html
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html
- https://cert-portal.siemens.com/productcert/html/ssa-485750.html
- https://cert-portal.siemens.com/productcert/html/ssa-585531.html
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9232.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-9232
- https://openssl-library.org/news/secadv/20250930.txt
- https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35
- https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b
- https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3
- https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf
- https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0
Affected packages
Git / github.com/alsyundawy/openssl-1.0.2
Affected ranges
- Type
- GIT
- Repo
- https://github.com/alsyundawy/openssl-1.0.2
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2" }, { "fixed": "1.0.2zm" } ], "source": "CPE_RANGE" } ] }
- Type
- GIT
- Repo
- https://github.com/kzalewski/openssl-1.1.1
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1" }, { "fixed": "1.1.1zd" } ], "source": "CPE_RANGE" } ] }
- Type
- GIT
- Repo
- https://github.com/openssl/openssl
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2" }, { "fixed": "1.0.2zm" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1" }, { "fixed": "1.1.1zd" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0" }, { "fixed": "3.0.18" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.2.0" }, { "fixed": "3.2.6" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.3.0" }, { "fixed": "3.3.5" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.4.0" }, { "fixed": "3.4.3" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.5.0" }, { "fixed": "3.5.4" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "2b4ec20e47959170422922eaff25346d362dcb35" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "654dc11d23468a74fc8ea4672b702dd3feb7be4b" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "7cf21a30513c9e43c4bc3836c237cf086e194af3" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "89e790ac431125a4849992858490bed6b225eadf" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "bbf38c034cdabd0a13330abcc4855c866f53d2e0" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
openssl-3.*
openssl-3.0.0
openssl-3.0.1
openssl-3.0.10
openssl-3.0.11
openssl-3.0.12
openssl-3.0.13
openssl-3.0.14
openssl-3.0.15
openssl-3.0.16
openssl-3.0.17
openssl-3.0.2
openssl-3.0.3
openssl-3.0.4
openssl-3.0.5
openssl-3.0.6
openssl-3.0.7
openssl-3.0.8
openssl-3.0.9
openssl-3.2.0
openssl-3.2.1
openssl-3.2.2
openssl-3.2.3
openssl-3.2.4
openssl-3.2.5
openssl-3.3.0
openssl-3.3.1
openssl-3.3.2
openssl-3.3.3
openssl-3.3.4
openssl-3.4.0
openssl-3.4.1
openssl-3.4.2
openssl-3.5.0
openssl-3.5.1
openssl-3.5.2
openssl-3.5.3
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9232.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "42797208737688127763066522181332281160",
"length": 507
},
"id": "CVE-2025-9232-17161750",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
"target": {
"file": "test/ec_internal_test.c",
"function": "setup_tests"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"230361427007416664995616424352791763469",
"68454496777232705137616949383570055801",
"174227485603324825134703660955423564225",
"306374039697804480350160125378658725435",
"223787537721903344733141597182001711142",
"305852724676774806958748002571762917320",
"61902118637910596077004663207701223681",
"278724473247779637198513168995006009135",
"150804929727413209120953746872414715465",
"166774358343717215765245239236385866693",
"116293081894868411264108492273509366961",
"326496170417124709669304286305887789679",
"278306348133167756990680493182074324125",
"189649085256091224929149730235838635518",
"82945606976757935725900546138315651129",
"136187505923069729147869676886657763243",
"233447734599456461300796481665382809870",
"116930820689846462220149337293161556595",
"153181275943870954612030432229689150702",
"65985025876624501603393736976041980125"
],
"threshold": 0.9
},
"id": "CVE-2025-9232-3349f255",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
"target": {
"file": "crypto/bn/bn_gf2m.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "30673062630639656303483208802482655434",
"length": 494
},
"id": "CVE-2025-9232-4f7f516c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
"target": {
"file": "crypto/bn/bn_gf2m.c",
"function": "BN_GF2m_poly2arr"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"280817224452240206430093593508711998688",
"191549696440367780559709063304346948740",
"203099402604054992460750042534343877170",
"208386829564166036621811124256000231791"
],
"threshold": 0.9
},
"id": "CVE-2025-9232-5b447975",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf",
"target": {
"file": "crypto/http/http_lib.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"280817224452240206430093593508711998688",
"191549696440367780559709063304346948740",
"203099402604054992460750042534343877170",
"208386829564166036621811124256000231791"
],
"threshold": 0.9
},
"id": "CVE-2025-9232-7d81e74d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0",
"target": {
"file": "crypto/http/http_lib.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "292430765755867081677309465971519558590",
"length": 778
},
"id": "CVE-2025-9232-7f78c982",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35",
"target": {
"file": "crypto/http/http_lib.c",
"function": "use_proxy"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "292430765755867081677309465971519558590",
"length": 778
},
"id": "CVE-2025-9232-9430a645",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3",
"target": {
"file": "crypto/http/http_lib.c",
"function": "use_proxy"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"280817224452240206430093593508711998688",
"191549696440367780559709063304346948740",
"203099402604054992460750042534343877170",
"208386829564166036621811124256000231791"
],
"threshold": 0.9
},
"id": "CVE-2025-9232-9c2be9ca",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b",
"target": {
"file": "crypto/http/http_lib.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"280817224452240206430093593508711998688",
"191549696440367780559709063304346948740",
"203099402604054992460750042534343877170",
"208386829564166036621811124256000231791"
],
"threshold": 0.9
},
"id": "CVE-2025-9232-acc86cbe",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35",
"target": {
"file": "crypto/http/http_lib.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"280817224452240206430093593508711998688",
"191549696440367780559709063304346948740",
"203099402604054992460750042534343877170",
"208386829564166036621811124256000231791"
],
"threshold": 0.9
},
"id": "CVE-2025-9232-c0b402f3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3",
"target": {
"file": "crypto/http/http_lib.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"28170854778703993674264004058177114599",
"73132526844288570625317440636111911761",
"177405411499435185068645597737938634778",
"224809958623850711330610094965797758930",
"295554444428855106393106961197201359586"
],
"threshold": 0.9
},
"id": "CVE-2025-9232-c377fa22",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/e04bd3433fd84e1861bf258ea37928d9845e6a86",
"target": {
"file": "include/openssl/opensslv.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "292430765755867081677309465971519558590",
"length": 778
},
"id": "CVE-2025-9232-cb61dc5c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf",
"target": {
"file": "crypto/http/http_lib.c",
"function": "use_proxy"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "292430765755867081677309465971519558590",
"length": 778
},
"id": "CVE-2025-9232-ceff507a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0",
"target": {
"file": "crypto/http/http_lib.c",
"function": "use_proxy"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"251633914150035957322733061977107206211",
"338514574181828579838011565939158652696",
"76638288692106140328510055542557597351",
"142922657400765574308962710386922248045",
"71649992455794854055653842592139575350",
"65527166711110472566013424527579064967",
"253196866009476977787139000804413898733",
"172177136897997206866313011107384691461"
],
"threshold": 0.9
},
"id": "CVE-2025-9232-e051451f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/e818b74be2170fbe957a07b0da4401c2b694b3b8",
"target": {
"file": "crypto/opensslv.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"202560716467995180801900703314012126638",
"231076714992210239911677876085986544653",
"119476550149019858610160764241585512883",
"237713134421560846878241190267682686452",
"291912177671523663250360670212314966717",
"148718397703357758449784276736258891876",
"8308956487359903771982894414540058331",
"219665286569007368979236427780197060159"
],
"threshold": 0.9
},
"id": "CVE-2025-9232-f19f6747",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
"target": {
"file": "test/ec_internal_test.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"215474658839038190857768659117172798903",
"224789752300883698945153787266757617261",
"56494159630746388130037307952134413004",
"164370382436795402003615230331141913984",
"149153318460680570484795927015804201404"
],
"threshold": 0.9
},
"id": "CVE-2025-9232-fa870959",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
"target": {
"file": "include/openssl/opensslv.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "292430765755867081677309465971519558590",
"length": 778
},
"id": "CVE-2025-9232-febf0b76",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b",
"target": {
"file": "crypto/http/http_lib.c",
"function": "use_proxy"
}
}
]
vanir_signatures_modified
"2026-11-11T13:19:32Z"