---
id: CVE-2025-9232
title: Out-of-bounds read in HTTP client no_proxy handling
summary: >-
  Issue summary: An application using the OpenSSL HTTP client API functions may

  trigger an out-of-bounds read if the 'no_proxy' environment variable is set
  and

  the host portion of the authority component of the HTTP URL is an IPv6
  address.…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
cwe:
  - CWE-125
vendor: OpenSSL
product: OpenSSL
affected:
  - OpenSSL >= 3.5.0 < 3.5.4
  - OpenSSL >= 3.4.0 < 3.4.3
  - OpenSSL >= 3.3.3 < 3.3.5
  - OpenSSL >= 3.2.4 < 3.2.6
  - OpenSSL >= 3.0.16 < 3.0.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-09-30T19:22:31.407504Z'
published: '2025-09-30'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:02:23.968Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-9232'
references:
  - url: 'https://openssl-library.org/news/secadv/20250930.txt'
    label: OpenSSL Advisory
  - url: >-
      https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35
    label: 3.5.4 git commit
  - url: >-
      https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3
    label: 3.4.3 git commit
  - url: >-
      https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0
    label: 3.3.5 git commit
  - url: >-
      https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf
    label: 3.2.6 git commit
  - url: >-
      https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b
    label: 3.0.18 git commit
tags:
  - cve.org
epss: 0.02001
epssPercentile: 0.80359
ingestedAt: '2026-10-15T04:46:37.350Z'
---

## Overview

Issue summary: An application using the OpenSSL HTTP client API functions may
trigger an out-of-bounds read if the 'no_proxy' environment variable is set and
the host portion of the authority component of the HTTP URL is an IPv6 address.

Impact summary: An out-of-bounds read can trigger a crash which leads to
Denial of Service for an application.

The OpenSSL HTTP client API functions can be used directly by applications
but they are also used by the OCSP client functions and CMP (Certificate
Management Protocol) client implementation in OpenSSL. However the URLs used
by these implementations are unlikely to be controlled by an attacker.

In this vulnerable code the out of bounds read can only trigger a crash.
Furthermore the vulnerability requires an attacker-controlled URL to be
passed from an application to the OpenSSL function and the user has to have
a 'no_proxy' environment variable set. For the aforementioned reasons the
issue was assessed as Low severity.

The vulnerable code was introduced in the following patch releases:
3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.

The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
issue, as the HTTP client implementation is outside the OpenSSL FIPS module
boundary.

## Affected

- `OpenSSL >= 3.5.0 < 3.5.4`
- `OpenSSL >= 3.4.0 < 3.4.3`
- `OpenSSL >= 3.3.3 < 3.3.5`
- `OpenSSL >= 3.2.4 < 3.2.6`
- `OpenSSL >= 3.0.16 < 3.0.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.