High 7.5Published Feb 16, 2021

CVE-2021-23840Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integ…

Updated under an hour ago (Nov 2, 2026, 1:40 AM ET)

Does this affect you?

It affects openssl and 20 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for openssl Exploited in the last 30 days

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

CVSS: 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-190
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Jun 16, 2026
First seen by InfoSec Signals: Nov 1, 2026

Affected products

Affected products

openssl openssl openssl:openssl	from 1.0.2 before 1.0.2y; from 1.1.1 before 1.1.1j	NVD
debian debian_linux debian:debian_linux	10.0	NVD
tenable log_correlation_engine tenable:log_correlation_engine	before 6.0.8	NVD
tenable nessus_network_monitor tenable:nessus_network_monitor	5.11.0; 5.11.1; 5.12.0; 5.12.1; 5.13.0	NVD
oracle business_intelligence oracle:business_intelligence	5.5.0.0.0; 5.9.0.0.0; 12.2.1.3.0; 12.2.1.4.0	NVD
oracle communications_cloud_native_core_policy oracle:communications_cloud_native_core_policy	1.15.0	NVD
oracle enterprise_manager_for_storage_management oracle:enterprise_manager_for_storage_management	13.4.0.0	NVD
oracle enterprise_manager_ops_center oracle:enterprise_manager_ops_center	12.4.0.0	NVD
oracle graalvm oracle:graalvm	19.3.5; 20.3.1.2; 21.0.0.2	NVD
oracle jd_edwards_enterpriseone_tools oracle:jd_edwards_enterpriseone_tools	before 9.2.6.0	NVD
1–10 of 21

References

References

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf	third-party-advisory
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846	third-party-advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10366	third-party-advisory
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
https://security.gentoo.org/glsa/202103-03	third-party-advisory
https://security.netapp.com/advisory/ntap-20210219-0009/	third-party-advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
1–10 of 20

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.