Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate.
Impact summary: If a user intends to make a trusted certificate rejected for a particular use it will be instead marked as trusted for that use.
A copy & paste error during minor refactoring of the code introduced this issue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate should be trusted only for the purpose of authenticating TLS servers but not for CMS signature verification and the CMS signature verification is intended to be marked as rejected with the -addreject option, the resulting CA certificate will be trusted for CMS signature verification purpose instead.
Only users which use the trusted certificate format who use the openssl x509 command line application to add rejected uses are affected by this issue. The issues affecting only the command line application are considered to be Low severity.
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this issue.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade openssl | Aug 8, 2025 | May 22, 2025 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 22, 2025 |
| Debian | — | Upgrade openssl | Jul 23, 2026 | Jul 23, 2026 |
| Freebsd | — | Upgrade openssl35 | May 24, 2025 | May 23, 2025 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Mar 5, 2026 | May 22, 2025 |
| Suse | — | Upgrade libopenssl3-x86-64-v3Upgrade libopenssl-3-develUpgrade libopenssl-3-fips-provider-x86-64-v3Upgrade libopenssl-3-fips-providerUpgrade openssl-3Upgrade libopenssl3Upgrade openssl-3-doc | Nov 5, 2025 | May 31, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub