CVE-2015-0291: The sigalgs implementation in t1_lib.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a de...

Security readout for executives and security teams

CVE-2015-0291 is a denial-of-service flaw in OpenSSL 1.0.2 before 1.0.2a. A remote client could trigger a crash in an affected TLS service during renegotiation. The known impact is service availability, not data theft or code execution. Exposure is most likely on TLS-enabled servers, applications, appliances, or vendor products using OpenSSL 1.0.2 before 1.0.2a. Downstream vendor advisories indicate packaged products may also need vendor-specific updates. Treat this as an availability risk. It is old and not KEV-listed, but any remaining affected internet-facing TLS service could be remotely crashed and should be upgraded or vendor-patched. Mitigation focus: Upgrade affected OpenSSL 1.0.2 installations to 1.0.2a or later.; Apply vendor updates for appliances or bundled software using OpenSSL.; Check OpenSSL and downstream vendor advisories before relying on compensating controls..

Prepared

Jun 13, 2026, 22:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.