OpenSSL Patches Three Flaws: Timing Side-Channel RCE Risk and Memory Corruption Affect All Versions

OpenSSL has patched three vulnerabilities affecting multiple versions, including risks from denial-of-service to potential remote code execution and private key recovery, according to the advisory. The most critical, CVE-2025-9230, is an out-of-bounds read and write in RFC 3211 KEK Unwrap that can crash or allow code execution; all major versions are affected, and users are advised to upgrade to patched releases 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.1.1zd and 1.0.2zm.

CVE-2025-9231 describes a timing side-channel in SM2 on ARM64, with versions 3.5, 3.4, 3.3 and 3.2 vulnerable and needing update to their patched releases. CVE-2025-9232 involves an out-of-bounds read in the HTTP client no_proxy handling when the URL contains an IPv6 address, with limited exploitation to crashes but potential impact on higher-level components. The advisory notes that the FIPS modules from 3.0 through 3.5 are not affected, as the vulnerable code lies outside the FIPS module boundary.