2026-04-23 11:59 UTC
@thomas_zahner@mastodon.social it looks like they were now all downgraded to "medium" or "low" severity? (still bad, but I guess *less* bad?)
Replies (2)
-
@thomas_zahner@mastodon.social 2026-04-27 07:06
@decathorpe@mastodon.social Hmm I still see them as high severity, but not sure how easy it is to exploit them in the real world. As far as I understand many of the vulnerabilities are caused by FFI and incorrect pointer logic, after all the library is just bindings for OpenSSL. rustls in contrast is a full Rust implementation reducing the need for unsafe code and raw pointers, which reduces the probability of such bugs greatly.
-
@thomas_zahner@mastodon.social 2026-04-27 07:08
@decathorpe@mastodon.social https://app.opencve.io/cve/CVE-2026-41676 https://app.opencve.io/cve/CVE-2026-41677 https://app.opencve.io/cve/CVE-2026-41678 https://app.opencve.io/cve/CVE-2026-41681