Unchecked callback lengths in PSK and cookie callbacks

X509Ref::ocsp_responders can produce a &str that is not valid UTF-8

Out-of-bounds read when a PEM password callback returns an oversized length

Buffer overflow with AES key wrap with padding in cipher_update_inplace

Buffer overflow in MdCtxRef::digest_final

Buffer overflow with AES key wrap with padding in cipher_update

Buffer overflow in Deriver::derive and PkeyCtxRef::derive with OpenSSL 1.1.x

Out-of-bounds write in aes::unwrap_key

Use-After-Free in Md::fetch and Cipher::fetch

ssl::select_next_proto use after free

MemBio::get_buf has undefined behavior with empty buffers

openssl X509StoreRef::objects is unsound

openssl X509VerifyParamRef::set_host buffer over-read

openssl X509Extension::new and X509Extension::new_nid null pointer dereference

openssl SubjectAlternativeName and ExtendedKeyUsage::other allow arbitrary file read

openssl X509NameBuilder::build returned object is not thread safe

SSL/TLS MitM vulnerability due to insecure defaults

Use after free in CMS Signing