Vulnerabilities in end-of-life OpenSSL
OpenSSL 1.0.2 and 1.1.1 are past end of life, and 3.0 joined them on 7 September 2026. Old Linux distributions still ship them. These are the versions in use, with every vulnerability the US National Vulnerability Database lists for them.
Request a server assessmentOpenSSL versions in end-of-life distributions
| OpenSSL | Ships with | Branch end of life | Known CVEs | Critical | Exploited | Forkward |
|---|---|---|---|---|---|---|
| 1.0.1e | CentOS 6 | 31 December 2016 | 77 | 7 | 1 | Patch on order, 48 h |
| 1.0.2g | Ubuntu 16.04 | 31 December 2019 | 62 | 3 | 0 | Patch on order, 48 h |
| 1.0.2k | CentOS 7, RHEL 7, Oracle Linux 7 and Amazon Linux 2 | 31 December 2019 | 48 | 0 | 0 | Patch on order, 48 h |
| 1.0.2u | Last OpenSSL 1.0.2 release | 31 December 2019 | 35 | 0 | 0 | Patch on order, 48 h |
| 1.1.1 | Ubuntu 18.04 | 11 September 2023 | 54 | 1 | 0 | Patch on order, 48 h |
| 1.1.1f | Ubuntu 20.04 | 11 September 2023 | 46 | 1 | 0 | Patch on order, 48 h |
| 1.1.1k | CentOS 8 | 11 September 2023 | 41 | 1 | 0 | Patch on order, 48 h |
| 1.1.1n | Debian 10 | 11 September 2023 | 37 | 0 | 0 | Patch on order, 48 h |
| 1.1.1w | Debian 11 | 11 September 2023 | 24 | 0 | 0 | Patch on order, 48 h |
| 3.0.22 | Last OpenSSL 3.0 release | 7 September 2026 | 6 | 0 | 0 | Patch on order, 48 h |
Vulnerabilities from the US National Vulnerability Database, 28 October 2026, for the upstream version, counting only entries where OpenSSL itself is the vulnerable product. Exploited: listed in the CISA catalogue of known exploited vulnerabilities. Package versions from each distribution's public repositories. Distribution builds include some vendor fixes; your assessment shows which risks are real.
End-of-life Linux
The distributions behind these versions, what else they still run, and when their support ended. End-of-life Linux
Patch on order, 48 h
We backport the fix to the version you run within 48 hours of your order, or within 24 hours with priority delivery. See the plans