onyx

onyx --cves cve-2021-4044

CVE-2021-4044

HIGHPOCNode.js
score
<0.1
cvss
7.5
epss
50.1%
published
2021-12-14
kev added
—
first seen

OpenSSL 3.0.0 contains a mishandling of negative return values from X509_verify_cert() during certificate verification, causing SSL_connect() or SSL_do_handshake() to return SSL_ERROR_WANT_RETRY_VERIFY unexpectedly, which may lead to crashes or infinite loops. This issue is worsened in combination with a bug in OpenSSL 3.0 that causes internal errors during certificate chain processing, especially with missing Subject Alternative Name and enforced name constraints, potentially leading to incorrect application behavior. Fixed in OpenSSL 3.0.1.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2021-12-14 — PublishedP2026-10-21 — Tracked by OnyxT2026-10-21 — Public PoCXscore2026-10-21: score <0.1<0.1epss2026-09-22: epss 50.1%2026-09-23: epss 50.1%2026-09-24: epss 50.1%2026-09-25: epss 50.1%2026-09-26: epss 50.1%2026-09-27: epss 50.1%2026-09-28: epss 50.1%2026-09-29: epss 50.1%2026-09-30: epss 50.1%2026-10-01: epss 50.1%2026-10-02: epss 50.1%2026-10-03: epss 50.1%2026-10-04: epss 50.1%2026-10-05: epss 50.1%2026-10-06: epss 50.1%2026-10-07: epss 50.1%2026-10-08: epss 50.1%2026-10-09: epss 50.1%2026-10-10: epss 50.1%2026-10-11: epss 50.1%2026-10-12: epss 50.1%2026-10-13: epss 50.1%2026-10-14: epss 50.1%2026-10-15: epss 50.1%2026-10-16: epss 50.1%2026-10-18: epss 50.1%2026-10-19: epss 50.1%2026-10-20: epss 50.1%2026-10-21: epss 50.1%50.1%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Tracked by Onyx
  3. Public PoC

Exploit availability

Public PoC flagged by vulnx; no direct exploit link among the citations.

Weaknesses

CWE-835

References 3