CVE-2025-9232: OpenSSL HTTP Client DoS Vulnerability

CVE-2025-9232 Overview

CVE-2025-9232 is an out-of-bounds read vulnerability in OpenSSL's HTTP client API functions that can be triggered when processing IPv6 addresses in URLs while the no_proxy environment variable is set. Applications utilizing OpenSSL's HTTP client capabilities, including those leveraging OCSP client functions and CMP (Certificate Management Protocol) implementations, may be susceptible to this memory safety issue.

When an application passes an HTTP URL containing an IPv6 address in the host portion of the authority component, and the no_proxy environment variable is configured, OpenSSL's HTTP client code may read beyond allocated memory boundaries. This out-of-bounds read can result in an application crash, leading to a Denial of Service condition.

Critical Impact

Applications using OpenSSL HTTP client API functions can crash when processing attacker-controlled URLs with IPv6 addresses, causing Denial of Service when the no_proxy environment variable is set.

Affected Products

• OpenSSL 3.0.16
• OpenSSL 3.1.8
• OpenSSL 3.2.4
• OpenSSL 3.3.3
• OpenSSL 3.4.0
• OpenSSL 3.5.0

Discovery Timeline

• September 30, 2025 - CVE-2025-9232 published to NVD
• November 04, 2025 - Last updated in NVD database

Technical Details for CVE-2025-9232

Vulnerability Analysis

This vulnerability is classified as CWE-125: Out-of-bounds Read. The flaw exists in OpenSSL's HTTP client implementation when parsing URLs that contain IPv6 addresses. The vulnerable code path is triggered specifically when an application processes an HTTP URL where the host portion is an IPv6 address and the no_proxy environment variable has been configured on the system.

The OpenSSL HTTP client API functions can be invoked directly by applications or indirectly through higher-level OpenSSL features such as OCSP (Online Certificate Status Protocol) client functions and the CMP (Certificate Management Protocol) client implementation. While these internal implementations use URLs that are unlikely to be attacker-controlled, direct API usage by applications may expose them to exploitation if they process untrusted URLs.

It's important to note that the FIPS modules in OpenSSL versions 3.5, 3.4, 3.3, 3.2, 3.1, and 3.0 are not affected by this vulnerability, as the HTTP client implementation resides outside the OpenSSL FIPS module boundary.

Root Cause

The root cause of this vulnerability lies in improper boundary checking when parsing IPv6 addresses within URLs. The vulnerable code was introduced in specific patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0, and 3.5.0. When the HTTP client code processes a URL with an IPv6 address in the host field, and the no_proxy environment variable is set, the parsing logic fails to properly validate memory boundaries before reading, resulting in an out-of-bounds memory access.

Attack Vector

The attack requires several conditions to be met for successful exploitation:

1. The target application must use OpenSSL's HTTP client API functions
2. The no_proxy environment variable must be configured on the system
3. An attacker must be able to influence or control the URL passed to OpenSSL's HTTP client functions
4. The URL must contain an IPv6 address in the host portion

When these conditions are satisfied, the out-of-bounds read triggers a crash in the application. While this vulnerability can only cause a Denial of Service (crash) and does not lead to information disclosure or code execution, it can still be impactful for availability-critical services.

The vulnerability mechanism involves improper parsing of IPv6 address literals in URLs when checking against the no_proxy configuration. Technical details are available in the OpenSSL Security Advisory and the associated GitHub commits.

Detection Methods for CVE-2025-9232

Indicators of Compromise

• Unexpected application crashes in processes utilizing OpenSSL HTTP client functionality
• Core dumps or crash logs showing memory access violations in OpenSSL library functions
• Repeated crashes when applications process URLs containing IPv6 addresses

Detection Strategies

• Monitor application logs for segmentation faults or access violations in OpenSSL-linked processes
• Implement network monitoring to detect unusual patterns of HTTP requests with IPv6 host addresses
• Use memory sanitization tools (ASan, MSan) in testing environments to detect out-of-bounds reads
• Audit deployed OpenSSL versions against the affected version list (3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0, 3.5.0)

Monitoring Recommendations

• Configure crash reporting and analysis for applications using OpenSSL HTTP client APIs
• Monitor system availability for services that depend on OpenSSL HTTP functionality
• Track application restart frequency as an indicator of potential DoS exploitation
• Review the no_proxy environment variable configuration across production systems

How to Mitigate CVE-2025-9232

Immediate Actions Required

• Inventory all systems running affected OpenSSL versions (3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0, 3.5.0)
• Prioritize patching for applications that process untrusted URLs through OpenSSL HTTP client APIs
• Review and document which applications use OpenSSL HTTP client functionality
• Consider temporarily unset the no_proxy environment variable if patching is not immediately possible

Patch Information

OpenSSL has released security patches to address this vulnerability. Multiple commits have been made available across the affected release branches:

• Patch for branch (commit 2b4ec20)
• Patch for branch (commit 654dc11)
• Patch for branch (commit 7cf21a3)
• Patch for branch (commit 89e790a)
• Patch for branch (commit bbf38c0)

For complete details, refer to the OpenSSL Security Advisory and the Openwall OSS-Security Discussion.

Workarounds

• Unset the no_proxy environment variable if not required for application functionality
• Implement input validation to reject URLs with IPv6 addresses before passing to OpenSSL functions
• Use network-level filtering to restrict URL sources to trusted origins
• Deploy application-level exception handling to gracefully recover from crashes

# Temporary workaround: Unset no_proxy environment variable
unset no_proxy
unset NO_PROXY

# Verify OpenSSL version on system
openssl version -a

# Check if your application links against affected OpenSSL versions
ldd /path/to/application | grep libssl