CWE-599: Missing Validation of OpenSSL Certificate
The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
Last updated
Overview
CWE-599 (Missing Validation of OpenSSL Certificate) is a variant-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.
Real-world CVEs
12 recorded CVEs are caused by CWE-599 (Missing Validation of OpenSSL Certificate). The highest-severity and most recent are shown first. 2 new CWE-599 CVEs have been recorded so far in 2026 (5 in 2025).
- CVE-2025-12553
Server Certificate Verification Disabled
Critical · CVSS 10.0 · EPSS 12th2025-10-31 - CVE-2024-41265
cortex establishes TLS connections with `InsecureSkipVerify` set to `true`
High · CVSS 8.7 · EPSS 17th2024-08-01 - CVE-2024-40464
Beego privilege escalation vulnerability
High · CVSS 8.7 · EPSS 46th2024-07-31