Cyber Resilience

CVE-2003-0545

Memory Safety in Openssl 0.9.6 … 0.9.7

High EPSSMemory Safety
Published
17 November 2003
Modified
16 April 2026
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.85 99.7th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2003-0545 is a critical-severity Double Free (CWE-415) vulnerability in Openssl Openssl. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding.

CWE(s)
CWE-415

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1499 Endpoint Denial of Service Impactconfidence: HIGH
Double-free in SSL certificate parsing can crash the server process, enabling an endpoint denial-of-service condition.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-35188Same product: Openssl Openssl
CVE-2026-31789Same product: Openssl Openssl
CVE-2026-34181Same product: Openssl Openssl
CVE-2025-69419Same product: Openssl Openssl
CVE-2026-45445Same product: Openssl Openssl
CVE-2024-0727Same product: Openssl Openssl
CVE-2023-5678Same product: Openssl Openssl
CVE-2025-15468Same product: Openssl Openssl
CVE-2026-45446Same product: Openssl Openssl
CVE-2026-42771Same product: Openssl Openssl

Affected Assets

openssl
openssl
0.9.6, 0.9.7

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure SDLC practices directly prevent double-free errors via static analysis, safe memory APIs, and testing.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development can detect double-free conditions before release.

A.8.25 Secure development life cycle partial match
prevents

Secure development life cycle includes memory-safety practices that can prevent double-free bugs.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate memory-safety rules that reduce double-free risk.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure system architecture and engineering principles can prescribe safe memory-management patterns.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly address proper use of free() and similar functions.

References