A few excerpts from the blog post (CVE-2024-5535 was assigned): > Meeting those constraints is quite unlikely nowadays: > NPN is a precursor to ALPN and wa

A few excerpts from the blog post (CVE-2024-5535 was assigned): > Meeting those constraints is quite unlikely nowadays: > NPN is a precursor to ALPN and was abandoned in 2012. It is very uncommon on internet servers now. > Node.js 10 and later removed NPN support, and is well past end-of-life. > Python 3.10 and later removed NPN support. OpenSSL advisory: https://openssl-library.org/news/secadv/20240627.txt https://openssl-library.org/news/secadv/20240627.txt > Severity: Low > Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. BoringSSL fix: https://boringssl.googlesource.com/boringssl/+/c1d9ac02514a138129872a036e3f8a1074dcb8bd https://boringssl.googlesource.com/boringssl/+/c1d9ac02514a1... The heap leak was independently observed in 2014 in the Android okhttp library: https://github.com/square/okhttp/issues/437#issuecomment-35860090 https://github.com/square/okhttp/issues/437#issuecomment-358...