CVE-2023-35784

CriticalCVSS 9.8

Published: 16/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.95%

56th percentile - higher than 56% of all known CVEs

Summary

In OpenBSD 7.2 before errata 026 and 7.3 before errata 004, as well as in LibreSSL before 3.6.3 and 3.7.x before 3.7.3, a double free or use after free could occur after SSL_clear.

Risk Assessment

This vulnerability may lead to unexpected application behavior, posing risks to the integrity and availability of systems using these software versions.

Recommendation

It is recommended to upgrade to the latest versions of OpenBSD and LibreSSL to mitigate this vulnerability.

Original NVD description (English source)

A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected.