Frontier models can vanish overnight. Control is the new frontier in security AI. See why→

AISLE Discovered 12 out of 12 OpenSSL Vulnerabilities

Author

AISLE Research Team

Published

openssl-2

See what AISLE can find and fix autonomously in your own code.

Sovereign AI CybersecurityTalk to Us

Autonomous zero-day discovery in one of the most scrutinized codebases in the world

AISLE's autonomous analyzer found all 12 CVEs in the January 2026 coordinated release of OpenSSL, the open-source cryptographic library that underpins a substantial proportion of the world’s secure communications. Some of these vulnerabilities had persisted in OpenSSL code for decades, evading the notice of thousands of security researchers.

Finding a genuine security flaw in OpenSSL is extraordinarily difficult. Even a single accepted vulnerability represents a rare achievement. The library's maturity and the community's vigilance make new discoveries exceptionally uncommon. This makes the January 2026 release an important milestone for autonomous security systems. As Tomáš Mráz, CTO of the OpenSSL Foundation, says,

“One of the most important sources of the security of the OpenSSL Library and open source projects overall is independent research. This release is fixing 12 security issues, all disclosed to us by AISLE. We appreciate the high quality of the reports and their constructive collaboration with us throughout the remediation.”

In this article, we’ll give an overview of our discoveries and explain why we think this is a watershed moment for AI-powered software security.

The Discoveries

The AISLE Research Team started hunting for OpenSSL vulnerabilities with our autonomous analyzer in August 2025. You can read about the three discoveries we made in Q3 of 2025 here. All of our discoveries were reported through responsible disclosure and resolved through coordinated releases with the OpenSSL project.

High and Moderate Severity CVEs

  • CVE-2025-15467: Stack Buffer Overflow in CMS AuthEnvelopedData Parsing (High): A vulnerability with the potential to enable remote code execution under specific conditions
  • CVE-2025-11187: PBMAC1 Parameter Validation in PKCS#12 (Moderate): Missing validation that could trigger a stack-based buffer overflow

Low Severity CVEs

  • CVE-2025-15468: Crash in QUIC protocol cipher handling
  • CVE-2025-15469: Silent truncation bug affecting post-quantum signature algorithms (ML-DSA)
  • CVE-2025-66199: Memory exhaustion via TLS 1.3 certificate compression
  • CVE-2025-68160: Memory corruption in line-buffering (affects code back to OpenSSL 1.0.2)
  • CVE-2025-69418: Encryption flaw in OCB mode on hardware-accelerated paths
  • CVE-2025-69419: Memory corruption in PKCS#12 character encoding
  • CVE-2025-69420: Crash in TimeStamp Response verification
  • CVE-2025-69421: Crash in PKCS#12 decryption
  • CVE-2026-22795: Crash in PKCS#12 parsing
  • CVE-2026-22796: Crash in PKCS#7 signature verification (affects code back to OpenSSL 1.0.2)

AISLE’s analyzer also recommended fixes which were incorporated directly into OpenSSL for 5 of the 12 CVEs.

Beyond CVEs: Catching Bugs Before They Ship

In addition to the 12 CVEs, 6 findings were never assigned a designation. In each case, AISLE detected the issue, reported it to the maintainers, and the fix was merged before the vulnerable code ever appeared in a release.

By integrating autonomous analysis directly into development workflows, security issues were identified and resolved before they reached users. That is our goal: preventing vulnerabilities, not merely patching them after deployment.

What This Means

OpenSSL represents one of the most deployed, battle-tested, and carefully maintained open-source projects in existence. The fact that 12 previously unknown vulnerabilities could still be found there, including issues dating back to 1998, suggests that manual review faces significant limits, even in mature, heavily audited codebases.

Human reviewers are constrained by time, attention, and the sheer volume of code in modern systems. Traditional static analysis catches certain bug classes but struggles with complex logic errors and timing-dependent issues. By contrast, autonomous AI-driven analysis operates at a different scale. It can examine code paths and edge cases that would take human reviewers months to cover, and it runs continuously rather than periodically.

This doesn't mean that AI can replace human expertise. The OpenSSL maintainers' deep knowledge of the codebase was essential for validating findings and developing robust fixes. But it does change the SLA of security. When autonomous discovery is paired with responsible disclosure, it collapses the time-to-remediation for the entire ecosystem.

The 12 OpenSSL vulnerabilities we identified, spanning 8+ subsystems from CMS to QUIC to post-quantum signatures, represent a milestone in our (admittedly ambitious) mission: moving from reactive patching to securing the software foundation that modern civilization depends on.

Collaboration with OpenSSL

From the moment our system flagged these anomalies, we approached this as a partnership with the OpenSSL community. We submitted detailed technical reports through their coordinated security reporting process, including complete reproduction steps, root cause analysis, and concrete patch proposals. In each case, our proposed fixes either informed or were directly adopted by the OpenSSL team.

As Matt Caswell, Executive Director of the OpenSSL Foundation, said, “Keeping widely deployed cryptography secure requires tight coordination between maintainers and researchers. We appreciate AISLE's responsible disclosures and the quality of their engagement across these issues."

The OpenSSL team's responsiveness was exceptional. Under the leadership of Tomáš Mráz, the Chief Technical Officer (CTO) at the OpenSSL Foundation, the maintainers engaged technically at every stage: validating findings, refining patches, coordinating releases across multiple branches, and synchronizing with downstream distributions.

Further Reading

For questions about AISLE's autonomous analyzer, reach out to us at [email protected].

Our appreciation goes to Tomáš Mráz, Matt Caswell, Neil Horman, and the OpenSSL team for their collaboration throughout this process. AISLE researchers contributing to these discoveries include Stanislav Fort, Petr Šimeček, Tomas Dulka, and Luigino Camastra.

Keep reading

More from AISLE

FeaturedResearchAISLE Discovered Six curl CVEs After OpenAI and Anthropic Found ZeroAfter frontier AI systems came up empty, AISLE surfaced six CVEs in curl, one of the world's most audited codebases. Its maintainers patched all six.Stanislav FortSeptember 2, 2026ResearchAISLE Discovers 6 High and Critical CVEs in FFmpegAISLE's AI-native engine found six high and critical CVEs in FFmpeg, including a 9.8 remote heap overflow and a stack overflow that survived 19 years.AISLE Research Team August 27, 2026ResearchAttackers Are Using AI to Find Vulnerabilities in Your Code. Your SAST Was Never Even Looking for ThemCan AI-native code analysis replace SAST, or is it just a complement. Here's what data from real-world results shows.Ondrej VlcekAugust 12, 2026ResearchAISLE Finds 21 Security Issues in FFmpeg, Including 6 New CVEsAISLE uncovered 21 issues in FFmpeg, including 6 new CVEs spanning code execution and out-of-bounds reads. All patched, with commit links inside.AISLE Research Team August 5, 2026ResearchAISLE Discovers a One-Click RCE Vulnerability in Cursor, VS Code, and Google AntigravityLearn how our AI found a one-click RCE vulnerability in 3 code editors: Cursor, VS Code, and Google Antigravity.Stanislav FortJuly 31, 2026ResearchThe Model That Fixes Your Code Might Hack the Linux KernelLearn how easy it is to trojanize a model, and what defenders can do to protect their supply chains from this emerging threat.Patrik MadaJuly 28, 2026PerspectivesThe Economics of Security Vulnerabilities: Why Discovery Is Not CommoditizingIf discovery is cheap, why are people willing to pay more for exploits than ever before? Here's what the market for exploits shows.Ondrej VlcekJuly 23, 2026ResearchAISLE Finds 8 CVEs Across MySQL, MariaDB, and PostgreSQLLearn how AISLE found 8 CVEs in critical databases using autonomous, AI-native analysis and verification.AISLE Research Team July 7, 2026ResearchAISLE Discovers 6 New CVEs in curl, Including the Oldest Issue Ever ReportedAISLE's analyzer discovered 6 new CVEs in curl, more than 2x the nearest AI security platform and including the oldest security issue in the project.AISLE Research Team June 24, 2026