CVE-2025-9232 Out-of-bounds read in HTTP client no_proxy handling
An attacker can cause a denial of service in applications using OpenSSL's HTTP client by triggering an out-of-bounds read via a crafted IPv6 URL when no_proxy is set.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-9232?
CVE-2025-9232 is a medium-severity denial of service vulnerability in OpenSSL, published on 30 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address.
Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application.
The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker.
In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity.
The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.
Weakness: CWE-125
Which versions are affected by CVE-2025-9232?
How do I fix CVE-2025-9232?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-9232 being exploited?
There is no known exploitation of CVE-2025-9232 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-9232, AZL-67977, AZL-78588, BELL-CVE-2025-9232, DEBIAN-CVE-2025-9232, ECHO-b2f7-5a6b-fae1 and 6 more.