CWE-599Missing Validation of OpenSSL Certificate

Abstraction: Variant · CVEs in our corpus: 14

The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.

Last updated: 20 August 2026 14:15 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.DS-02
PR.PS-06
PR.AA-03
IA-5 Authenticator Management

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V12.3.5
V17.2.8

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2025-12553`	7.1	9.8	0.0021	2025-10-31
`CVE-2024-40464`	6.6	8.8	0.0057	2024-07-31
`CVE-2021-21374`	6.1	8.1	0.0104	2021-03-26
`CVE-2022-31105`	6.0	8.3	0.0077	2022-07-12
`CVE-2026-25060`	6.0	8.1	0.0024	2026-02-02
`CVE-2024-41265`	5.7	7.5	0.0026	2024-08-01
`CVE-2025-56230`	5.7	7.5	0.0022	2025-11-04
`CVE-2023-48052`	5.6	7.4	0.0031	2023-11-16
`CVE-2024-41253`	5.1	7.1	0.0012	2024-07-31
`CVE-2024-36755`	5.0	6.8	0.0013	2024-06-27
`CVE-2025-56232`	5.0	6.8	0.0012	2025-11-05
`CVE-2025-56146`	4.2	5.3	0.0015	2025-09-23
`CVE-2025-63432`	3.7	4.6	0.0017	2025-11-24