OpenSSL: out-of-bounds read crashes the HTTP client when no_proxy is set and the URL host is IPv6

CVSS 5.9CVE-2025-9232Kernel, userspace & hypervisorcurated

Impact

An application calling the OpenSSL HTTP client API can read out of bounds and crash when the no_proxy environment variable is set and the host part of the URL authority is an IPv6 address. The same code backs OpenSSL's OCSP and CMP client paths, though the URLs those use are unlikely to be attacker-controlled. The outcome is limited to a crash of the calling process - on a GPU fleet that means a daemon doing certificate status checks dies, not a tenant boundary failing. OpenSSL rates it Low; it requires both an attacker-influenced URL reaching the API and a no_proxy setting in the environment. The vulnerable code was introduced in 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0, and the FIPS modules are outside the affected boundary.

Who can reach it

An attacker who can influence the URL an application passes to the OpenSSL HTTP client, on a host where no_proxy is set in the service environment. No authentication is implied by the record.

What to do

Update OpenSSL to a release carrying the referenced commits and restart the linked services. If an update cannot be scheduled immediately, removing no_proxy from the affected service environments avoids the vulnerable path. Rolling daemon restarts, not a node reboot.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-9232 https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35 https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.