Axtls Project maintains a compact, lightweight TLS/SSL library positioned for embedded and resource-constrained environments, yet despite its narrow product scope holds prominence in certain deployment contexts where cryptographic functionality is critical. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity, and recur through weakness classes including improper cryptographic signature verification, buffer overflows, out-of-bounds writes, and off-by-one errors that are endemic to low-level cryptographic and protocol-parsing code. Defenders integrating this library should prioritize tracking its releases and verify downstream applications have rebuilt with patched versions; current severity and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Axtls Project over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-8981CRITICAL tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer Overflow via a crafted sequence of TLS packets because the need_bytes value is mismanaged. | Mar 26, 2019 | 9.8 | 30 | NO | NO |
CVE-2019-10013HIGH The asn1_signature function in asn1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has a Buffer Overflow that allows remote attackers to cause a denial of service (memory and CPU c | Dec 3, 2019 | 7.5 | 24 | NO | NO |
CVE-2018-16149MEDIUM In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification blindly trusts the declared lengths in the ASN.1 structure. Consequently, when s | Nov 7, 2018 | 5.9 | 21 | NO | NO |
CVE-2018-16253MEDIUM In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently, a remote attacker can | Nov 7, 2018 | 5.9 | 20 | NO | NO |
CVE-2018-16150MEDIUM In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not reject excess data after the hash value. Consequently, a remote attacke | Nov 7, 2018 | 5.9 | 20 | NO | NO |
CVE-2019-9689HIGH process_certificate in tls1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has a Buffer Overflow via a crafted TLS certificate handshake message with zero certificates. | Dec 3, 2019 | 7.5 | 19 | NO | NO |
CVE-2023-33613MEDIUM axTLS v2.1.5 was discovered to contain a heap buffer overflow in the bi_import function in axtls-code/crypto/bigint.c. This vulnerability allows attackers to cause a Denial of Serv | Jun 6, 2023 | 5.5 | 18 | NO | NO |
CVE-2017-1000416MEDIUM axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year (19)50 of UTCTime being misinterpreted as 2050. | Jan 22, 2018 | 5.3 | 18 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Axtls Project.
Media articles that mention a CVE ID that affects a product developed by Axtls Project — matched by CVE ID, not by vendor name.