CVE-2009-4355: OpenSSL

Medium severity, CVSS 5.0. EPSS: 9.2% chance of exploitation in the next 30 days.

Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.

Affected products

• OpenSSL OpenSSL: up to and including 0.9.8l; version 0.9.1c only; version 0.9.2b only; version 0.9.3 only; version 0.9.3a only; version 0.9.4 only; …
• Red Hat OpenSSL: version 0.9.6-15 only; version 0.9.6b-3 only; version 0.9.7a-2 only

Published 2010-01-14. Last modified 2026-06-16.