CVE-2024-5535

Summary

CVE-2024-5535 is a vulnerability in OpenSSL's SSL_select_next_proto function, which may cause a crash or unintended data disclosure if called with an empty list of client protocols. This issue could result in up to 255 bytes of arbitrary data being sent to the peer, leading to a loss of confidentiality. This vulnerability primarily affects applications using the deprecated NPN (Next Protocol Negotiation) protocol, and is most likely to occur due to a configuration or programming error. The impact is assessed as low severity due to the limited attack surface and the fact that NPN is not widely used. No new releases of OpenSSL are planned at this time, but the fix will be included in future releases.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.