CVSS 3.0
8.1 highCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2016-10931
High (8.1) in rust-openssl project rust-openssl. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in openssl 0.9.0.
An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWE
- CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rust-openssl_project:rust-openssl
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-34p9-f4q3-c4r7 | crates.io | openssl | <0.9.0 | 0.9.0 |
| RUSTSEC-2016-0001 | crates.io | openssl | >=0.0.0-0 <0.9.0 | 0.9.0 |