CVE-2016-7054: OpenSSL

High severity, CVSS 7.5. EPSS: 32.4% chance of exploitation in the next 30 days.

In OpenSSL 1.1.0 before 1.1.0c, TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash. This issue is not considered to be exploitable beyond a DoS.

Affected products

• OpenSSL OpenSSL: version 1.1.0 only; version 1.1.0a only; version 1.1.0b only

Published 2017-05-04. Last modified 2026-06-17.