CVE-2024-5535

CVE-2024-5535 is a buffer overread vulnerability in the OpenSSL API function SSL_select_next_proto. It affects applications that directly call this function with an empty supported client protocols buffer, potentially leading to a crash or the disclosure of up to 255 bytes of private memory contents to a peer. While the CVSS score is 9.1 (CRITICAL), OpenSSL assesses it as Low severity due to the specific conditions required for exploitation, which typically involve application configuration or programming errors, and the unlikelihood of attacker control. There is no evidence of active exploitation, and no public exploit code is available, though it has garnered significant community discussion.