CVE-2014-3512: Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i...

Security readout for executives and security teams

CVE-2014-3512 is an OpenSSL SRP implementation flaw where malformed SRP parameters can crash affected software, and sources note possible unspecified impact. It affects OpenSSL 1.0.1 before 1.0.1i. Business risk is highest for legacy systems or products still using vulnerable OpenSSL with SRP exposed to remote connections. Exposure is likely limited to systems, appliances, or applications built with OpenSSL 1.0.1 before 1.0.1i and using reachable SRP functionality. Modern supported OpenSSL installations should not be affected if patched past the 2014 advisory level. Patch as a legacy exposure issue. It is not KEV-listed in the provided bundle, but remote crash risk in cryptographic infrastructure justifies timely remediation, especially for externally reachable systems. Mitigation focus: Upgrade affected OpenSSL 1.0.1 deployments to 1.0.1i or later vendor-fixed packages.; Apply distribution or appliance vendor updates where OpenSSL is bundled internally.; Disable SRP functionality where unused until affected systems are patched..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.