CVE-2025-15468

Public on 2026-01-27
Modified on 2026-01-27
Description
If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs.
Severity
Important severity
Important
See what this means
CVSS v3 Base Score
7.5
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core edk2 Not Affected
Amazon Linux 2 - Core openssl Not Affected
Amazon Linux 2023 openssl Pending Fix
Amazon Linux 2023 openssl-fips-provider-certified Not Affected
Amazon Linux 2 - Openssl-snapsafe Extra openssl-snapsafe Not Affected
Amazon Linux 2 - Core openssl11 Not Affected

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2025-15468 Mitre: CVE-2025-15468