Answer in brief
CVE-2025-9232 records a Medium severity (CVSS 5.9) vulnerability in Out-of-bounds read in HTTP client no_proxy handling. The current sources do not mark it as known exploited. The current feed maps OpenSSL/OpenSSL (generic), Siemens/RUGGEDCOM RST2428P (generic), Siemens/RUGGEDCOM RST2428P (generic), Siemens/SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps OpenSSL/OpenSSL (generic), Siemens/RUGGEDCOM RST2428P (generic), Siemens/RUGGEDCOM RST2428P (generic), Siemens/SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| OpenSSL/OpenSSLgeneric | >=3.5.0 <3.5.4 || >=3.4.0 <3.4.3 || >=3.3.3 <3.3.5 || >=3.2.4 <3.2.6 || >=3.0.16 <3.0.18 | 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18 |
| Siemens/RUGGEDCOM RST2428Pgeneric | >=0 <V3.3 | V3.3 |
| Siemens/RUGGEDCOM RST2428Pgeneric | >=0 <V4.0 | V4.0 |
| Siemens/SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 familygeneric | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XCH328generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XCM324generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XCM328generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XCM332generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRH334 (24 V DC, 8xFO, CC)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (230 V AC, 12xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (230 V AC, 8xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (24 V DC, 12xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (24 V DC, 8xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (2x230 V AC, 12xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)generic | >=0 <V3.3 | V3.3 |
| Siemens/SCALANCE XRM334 (2x230 V AC, 8xFO)generic | >=0 <V3.3 | V3.3 |
| Siemens/SIDIS Primegeneric | >=0 <V4.0.800 | V4.0.800 |
| Siemens/SIDIS Secured SmartPluggeneric | >=0 <V7.26.0310 | V7.26.0310 |
| Siemens/SIMATIC CN 4100generic | >=0 <V5.0 | V5.0 |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
Published upstream
Sep 30, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 14, 2026
Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.
Quoted source text, attributed separately from HOL analysis.