CVE-2025-9232

Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.

• CWE-125

• https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35Patch
• https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4bPatch
• https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3Patch
• https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadfPatch
• https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0Patch
• https://openssl-library.org/news/secadv/20250930.txtVendor Advisory
• https://www.openwall.com/lists/oss-security/2025/09/30/5Mailing List, Third Party Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlThird Party Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlThird Party Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-089022.htmlThird Party Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-253495.htmlThird Party Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-485750.htmlThird Party Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-585531.htmlThird Party Advisory

Published

Sep 30, 2025

Last Modified

Nov 9, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9226Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUti…4.6
• CVE-2025-9227Zohocorp ManageEngine OpManager versions 128609 and below ar…6.5
• CVE-2025-9228MiR software versions prior to version 3.0.0 have insufficie…4.3
• CVE-2025-9229Information disclosure vulnerability in error handling in Mi…5.3
• CVE-2025-9230Issue summary: An application trying to decrypt CMS messages…9.8
• CVE-2025-9231Issue summary: A timing side-channel which could potentially…5.9
• CVE-2025-9233A security vulnerability has been detected in Scada-LTS up t…5.4
• CVE-2025-9234A vulnerability was detected in Scada-LTS up to 2.7.8.1. The…5.4
• CVE-2025-9235A flaw has been found in Scada-LTS up to 2.7.8.1. The impact…5.4
• CVE-2025-9236A vulnerability has been found in Portabilis i-Educar up to …8.8
• CVE-2025-9237A vulnerability was found in CodeAstro Ecommerce Website 1.0…5.4
• CVE-2025-9238A vulnerability was determined in Swatadru Exam-Seating-Arra…7.3