CVE-2016-2176: OpenSSL

High severity, CVSS 8.2. EPSS: 23.4% chance of exploitation in the next 30 days.

The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.

Affected products

• OpenSSL OpenSSL: up to and including 1.0.1s; version 1.0.2 only; version 1.0.2a only; version 1.0.2b only; version 1.0.2c only; version 1.0.2d only; …

Published 2016-05-05. Last modified 2026-06-17.