PolarSSL has had their own fair share of nasties. Only a few months after Heartbleed they had a remote code execution in the ASN.1-parser. They fixed it quickly

PolarSSL has had their own fair share of nasties. Only a few months after Heartbleed they had a remote code execution in the ASN.1-parser. They fixed it quickly however, and keep a current CVE list at their home page. It just goes to show that all popular SSL options are more or less bad (and the same goes for IPsec).