Servers and applications
CVE-2011-4576 The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.
Severity Medium 5.0
Published 6 Jan 2012
Last changed 16 Jun 2026
Added to UpHeron 21 Oct 2026 Exploit chance 16% in the next 30 daysHigher than 96% of CVEs. EPSS by FIRST , 12 Nov 2026
Attack Over the network · No login needed
Attacker can Read some data
CVSS vector AV:N/AC:L/Au:N/C:P/I:N/A:N
Sources NVD Affected software Software Affected versions OpenSSLServers and applications · cpe:a:openssl:openssl Version 1.0.0d Version 1.0.0c Version 1.0.0b Version 1.0.0a All 64 release lines Every version up to 0.9.8r Every version up to 1.0.0e Version 0.9.1c Version 0.9.2b Version 0.9.4 Version 0.9.5 Version 0.9.5a Version 0.9.6 Version 0.9.6a Version 0.9.6b Version 0.9.6c Version 0.9.6d Version 0.9.6e Version 0.9.6f Version 0.9.6g Version 0.9.6h Version 0.9.6h-bogus Version 0.9.6i Version 0.9.6j Version 0.9.6k Version 0.9.6l Version 0.9.6m Version 0.9.7 Version 0.9.7a Version 0.9.7b Version 0.9.7c Version 0.9.7d Version 0.9.7e Version 0.9.7f Version 0.9.7g Version 0.9.7h Version 0.9.7i Version 0.9.7j Version 0.9.7k Version 0.9.7l Version 0.9.7m Version 0.9.8 Version 0.9.8a Version 0.9.8b Version 0.9.8c Version 0.9.8d Version 0.9.8e Version 0.9.8f Version 0.9.8g Version 0.9.8h Version 0.9.8i Version 0.9.8j Version 0.9.8k Version 0.9.8l Version 0.9.8m Version 0.9.8n Version 0.9.8o Version 0.9.8p Version 0.9.8q Version 1.0.0-beta1 Version 1.0.0-beta2 Version 1.0.0-beta3 Version 1.0.0-beta4 Version 1.0.0-beta5 Version 1.0.0 Version 1.0.0a Version 1.0.0b Version 1.0.0c Version 1.0.0d
References NVD https://nvd.nist.gov/vuln/detail/CVE-2011-4576 CVE.org https://www.cve.org/CVERecord?id=CVE-2011-4576