CVE-2024-5535 is a bug in OpenSSL that has been present since 2011, allowing the leakage of up to 255 bytes of the client's heap data to the server when the SSL_select_next_proto function is called with a client buffer that is not a valid list of protocols. This bug affects OpenSSL, BoringSSL, Node.js, and Python versions prior to specific updates that removed NPN support. Despite being low severity, it could have resulted in memory safety issues.
Give a Pawfive to this post!
Share with your friends and followers
Start writing about what excites you in tech — connect with developers, grow your voice, and get rewarded.
Join other developers and claim your FAUN.dev() account now!
