OpenSSL 1.1.1 < 1.1.1za Vulnerability

CVE-2024-5535 is a buffer overread in OpenSSL's SSL_select_next_proto function. When a calling application passes a zero-length client protocol list — a scenario that only arises from a programming error or misconfiguration in the application itself, not from anything an attacker sends — the function returns a pointer to up to 255 bytes of adjacent memory, which may then be transmitted to the remote peer. The flaw affects OpenSSL 1.1.1 through 1.1.1z (fixed in 1.1.1za, available only under premium support), as well as 3.0.x < 3.0.15, 3.1.x < 3.1.7, 3.2.x < 3.2.3, and 3.3.x < 3.3.2. It is associated with NPN (Next Protocol Negotiation), a deprecated predecessor to ALPN that almost no modern application uses.

Tenable inherits an NVD-assigned CVSS base score of 9.1 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), which assumes an unauthenticated remote attacker can trivially trigger the bug with no interaction. This is flatly wrong. The OpenSSL project itself rates this Low because the triggering condition — an empty client protocol list — is a local application bug, not something an attacker can inject over the wire. The CVSS vector's AC:L is indefensible; exploitation requires a pre-existing programming error in the consuming application that the attacker does not control. The 9.1 score has caused unnecessary fire drills across thousands of enterprises and should be disregarded.

Why this verdict

• Attacker control is absent. The vulnerable code path requires the *calling application* to pass a zero-length client protocol list to SSL_select_next_proto. This is an application-layer programming error, not a condition an attacker can create by crafting TLS messages. The CVSS vector's AC:L is wrong; realistic attack complexity is effectively theoretical.
• NPN is dead technology. The flaw is only reachable through NPN (Next Protocol Negotiation), deprecated since RFC 7301 in 2014. ALPN replaced it universally. Finding a production system that uses NPN in 2026 is like finding a fax machine at a startup.
• Impact ceiling is 255 bytes of uncontrolled disclosure. Even if triggered, the attacker gets a small, non-targeted memory fragment. No code execution, no write primitive, no lateral movement, no persistence. This is not a Heartbleed-class leak — there is no ability to repeatedly target specific secrets.
• OpenSSL rates it Low. The vendor that maintains the code — who has every incentive to err on the side of caution — explicitly rates this Low severity. The NVD 9.1 score is a mechanical CVSS calculation that ignores the application-layer precondition.
• Role multiplier: OpenSSL is ubiquitous and runs on high-value infrastructure (load balancers, identity providers, database TLS, edge appliances). However, the attack chain *does not succeed* in any role without a pre-existing application bug that passes empty protocol lists via NPN. No widely-deployed high-value application (nginx, Apache, HAProxy, Node.js, PostgreSQL, etc.) has been shown to contain this specific programming error. The blast radius is therefore not fleet-scale or identity-scale in any realistic deployment, and the role multiplier does not elevate the floor.

Why not higher?

Upgrading to MEDIUM or above would require evidence of a real-world application that exposes the vulnerable code path under attacker-controlled conditions, or evidence of in-the-wild exploitation. Neither exists. The OpenSSL project's own Low rating, the absence from KEV, and the lack of any known campaign all confirm this is not a practically exploitable vulnerability.

Why not lower?

IGNORE would be appropriate only if no affected hosts exist. Since OpenSSL 1.1.1 is still widely deployed (especially on systems that missed the EOL transition), the version-detection finding has hygiene value: it flags hosts running EOL OpenSSL that need to be migrated to 3.x regardless of this specific CVE. The PoC's existence and the theoretical 255-byte leak keep this above zero risk.

1. Confirm your applications use ALPN, not NPN — Audit TLS configurations on all services linked against OpenSSL 1.1.1. If ALPN is in use (it almost certainly is), the vulnerable code path is unreachable. This is a validation step, not a mitigation — but it confirms you can deprioritize. No mitigation SLA applies at LOW severity.
2. Prioritize migration off OpenSSL 1.1.1 entirely — OpenSSL 1.1.1 reached public EOL on 2023-09-11. The real risk is not CVE-2024-5535 — it is running an unsupported cryptographic library. Plan migration to OpenSSL 3.x within your standard LOW remediation window (backlog hygiene).
3. Apply distro-provided backport patches where available — RHEL, Ubuntu, Debian, and SUSE have all shipped patched versions. Apply during normal patch cycles. No accelerated timeline is needed.

Run on each target host where OpenSSL 1.1.1 may be installed. Execute as any user with read access to the openssl binary. Example: bash check_cve_2024_5535.sh or bash check_cve_2024_5535.sh /usr/local/ssl/bin/openssl to specify a non-default path.

#!/usr/bin/env bash
# check_cve_2024_5535.sh — Check for CVE-2024-5535 (OpenSSL SSL_select_next_proto overread)
# Target: Linux/macOS hosts with OpenSSL 1.1.1
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

OPENSSL_BIN="${1:-openssl}"

if ! command -v "$OPENSSL_BIN" &>/dev/null; then
  echo "UNKNOWN — openssl binary not found at '$OPENSSL_BIN'"
  exit 2
fi

VERSION_STR=$("$OPENSSL_BIN" version 2>/dev/null || true)

if [[ -z "$VERSION_STR" ]]; then
  echo "UNKNOWN — could not determine OpenSSL version"
  exit 2
fi

echo "Detected: $VERSION_STR"

# Extract version components
if [[ "$VERSION_STR" =~ OpenSSL\ 1\.1\.1([a-z]*) ]]; then
  PATCH="${BASH_REMATCH[1]}"
  # 1.1.1za is the fix. Patches a-z are vulnerable; za+ are fixed.
  if [[ ${#PATCH} -ge 2 ]]; then
    echo "PATCHED — $VERSION_STR (>= 1.1.1za)"
    exit 0
  else
    echo "VULNERABLE — $VERSION_STR (< 1.1.1za, affected by CVE-2024-5535)"
    exit 1
  fi
elif [[ "$VERSION_STR" =~ OpenSSL\ 3\.0\.([0-9]+) ]]; then
  MINOR="${BASH_REMATCH[1]}"
  if (( MINOR >= 15 )); then
    echo "PATCHED — $VERSION_STR (>= 3.0.15)"
    exit 0
  else
    echo "VULNERABLE — $VERSION_STR (< 3.0.15)"
    exit 1
  fi
elif [[ "$VERSION_STR" =~ OpenSSL\ 3\.1\.([0-9]+) ]]; then
  MINOR="${BASH_REMATCH[1]}"
  if (( MINOR >= 7 )); then
    echo "PATCHED — $VERSION_STR (>= 3.1.7)"
    exit 0
  else
    echo "VULNERABLE — $VERSION_STR (< 3.1.7)"
    exit 1
  fi
elif [[ "$VERSION_STR" =~ OpenSSL\ 3\.2\.([0-9]+) ]]; then
  MINOR="${BASH_REMATCH[1]}"
  if (( MINOR >= 3 )); then
    echo "PATCHED — $VERSION_STR (>= 3.2.3)"
    exit 0
  else
    echo "VULNERABLE — $VERSION_STR (< 3.2.3)"
    exit 1
  fi
elif [[ "$VERSION_STR" =~ OpenSSL\ 3\.3\.([0-9]+) ]]; then
  MINOR="${BASH_REMATCH[1]}"
  if (( MINOR >= 2 )); then
    echo "PATCHED — $VERSION_STR (>= 3.3.2)"
    exit 0
  else
    echo "VULNERABLE — $VERSION_STR (< 3.3.2)"
    exit 1
  fi
elif [[ "$VERSION_STR" =~ OpenSSL\ 3\.[4-9] ]] || [[ "$VERSION_STR" =~ OpenSSL\ [4-9] ]]; then
  echo "PATCHED — $VERSION_STR (post-fix branch)"
  exit 0
else
  echo "UNKNOWN — version '$VERSION_STR' not in the affected range or not recognized"
  exit 2
fi

Sources

1. Tenable Plugin 201084
2. OpenSSL Vulnerabilities (1.1.1 series)
3. GitHub Advisory GHSA-4fc7-mvrr-wv2c
4. websecnl PoC — CVE-2024-5535
5. Red Hat CVE-2024-5535
6. Snyk — CVE-2024-5535
7. MITRE CVE Record