Skip to content
Back to search

CVE-2003-0545

CRITICAL
9.8NVD

Summary

generated automatically from NVD data

OpenSSL 0.9.7 contains a double free flaw (CWE-415) in its handling of SSL client certificates. A remote attacker can present a certificate with a particular invalid ASN.1 encoding to crash the application, causing a denial of service, and may possibly achieve arbitrary code execution. The flaw is rated CRITICAL with a CVSS v3.1 score of 9.8, and it is exploitable over the network without authentication or user interaction.

NVD description

Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding.

Share:

EPSS · FIRST.org

87.5%probability of exploitation in the next 30 days

Higher than 99% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-11-02, recomputed daily by FIRST.org.

CVSS v3.1 Score

9.8
/ 10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Information

Published
17 nov. 2003
Updated
16 juin 2026
Status
Modified
Source
cve@mitre.org

Affected products

openssl opensslAll OpenSSL CVEs →
Versions 0.9.6 · 0.9.7

Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.

Weaknesses (CWE)

CWE-415

References (20)

Similar CVEs

Other vulnerabilities of type CWE-415

…

Running OpenSSL? Know which CVEs hit your version.

Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.

Watch my OpenSSLI already have an account