Is CVE-2021-3450 being actively exploited?

CVE-2021-3450 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2021-3450?

CVE-2021-3450 has a CVSS 3.1 base score of 7.4 (HIGH).

CVE-2021-3450

HIGH · CVSS 7.4EPSS 18.3%EU EUVD

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).

Key facts

CVSS score: 7.4 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-295
EPSS score: 18.3% (97th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2021-1641)
Published: March 25, 2021
NVD last modified: October 8, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2021-1641 in the EU Vulnerability Database. Last updated in EUVD on October 8, 2026.

View on the EU Vulnerability Database

Affected products

fedoraproject / fedora
freebsd / freebsd
freebsd / freebsd
freebsd / freebsd
mcafee / web gateway
mcafee / web gateway
mcafee / web gateway
mcafee / web gateway cloud service
mcafee / web gateway cloud service
mcafee / web gateway cloud service
netapp / cloud volumes ontap mediator
netapp / oncommand workflow automation
netapp / ontap select deploy administration utility
netapp / santricity smi-s provider
netapp / santricity smi-s provider firmware
netapp / storagegrid
netapp / storagegrid
netapp / storagegrid firmware
nodejs / node.js
openssl / openssl
oracle / commerce guided search
oracle / enterprise manager for storage management
oracle / graalvm
oracle / graalvm
oracle / graalvm
oracle / jd edwards enterpriseone tools
oracle / jd edwards world security
oracle / mysql connectors
oracle / mysql enterprise monitor
oracle / mysql server
oracle / mysql workbench
oracle / peoplesoft enterprise peopletools
oracle / secure backup
oracle / secure global desktop
oracle / weblogic server
oracle / weblogic server
sonicwall / capture client
sonicwall / email security
sonicwall / sma100
sonicwall / sma100 firmware
sonicwall / sonicos
tenable / nessus
tenable / nessus agent
tenable / nessus network monitor
tenable / nessus network monitor
tenable / nessus network monitor
tenable / nessus network monitor
tenable / nessus network monitor
windriver / linux
windriver / linux

and 2 more…

Certified products that may be affected

12 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

SonicWall SonicOS/X v7.0.1 with VPN and IPS on NSsp 15700 - SonicWALL, Inc - Common Criteria CCEVS-VR-VID-11528-2025 - active
Sonicwall SonicOS/X v7.0.1 with VPN and IPS on TZ, NSa, NSsp, and NSv Appliances - SonicWALL, Inc - Common Criteria CCEVS-VR-VID-11473-2025 - active
Nessus Network Monitor 5.12.0 - Tenable, Inc. - Common Criteria CCEVS-VR-VID-11068-2020 - archived
Nessus Manager 8.11.1 - Tenable, Inc. - Common Criteria CCEVS-VR-VID-11067-2020 - archived
SonicWall SonicOS Enhanced V6.5.4 with VPN and IPS on TZ and SOHO Appliances - SonicWALL, Inc - Common Criteria CCEVS-VR-11028-2020 - archived

See all 12 in the Security Certifications Explorer.

References

http://www.openwall.com/lists/oss-security/2021/03/27/1(Mailing List, Third Party Advisory)
http://www.openwall.com/lists/oss-security/2021/03/27/2(Mailing List, Third Party Advisory)
http://www.openwall.com/lists/oss-security/2021/03/28/3(Mailing List, Third Party Advisory)
http://www.openwall.com/lists/oss-security/2021/03/28/4(Mailing List, Third Party Advisory)
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf(Third Party Advisory)
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845(Third Party Advisory)
https://kc.mcafee.com/corporate/index?page=content&id=SB10356(Third Party Advisory)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/
https://mta.openssl.org/pipermail/openssl-announce/2021-March/000198.html(Mailing List, Vendor Advisory)
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013(Third Party Advisory)
https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc(Third Party Advisory)
https://security.gentoo.org/glsa/202103-03(Third Party Advisory)
https://security.netapp.com/advisory/ntap-20210326-0006/(Third Party Advisory)
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd(Third Party Advisory)
https://www.openssl.org/news/secadv/20210325.txt(Vendor Advisory)
https://www.oracle.com//security-alerts/cpujul2021.html(Patch, Third Party Advisory)
https://www.oracle.com/security-alerts/cpuApr2021.html(Patch, Third Party Advisory)
https://www.oracle.com/security-alerts/cpuapr2022.html(Patch, Third Party Advisory)
https://www.oracle.com/security-alerts/cpujul2022.html(Patch, Third Party Advisory)
https://www.oracle.com/security-alerts/cpuoct2021.html(Patch, Third Party Advisory)
https://www.tenable.com/security/tns-2021-05(Third Party Advisory)
https://www.tenable.com/security/tns-2021-08(Third Party Advisory)
https://www.tenable.com/security/tns-2021-09(Third Party Advisory)

Last updated October 10, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain