&gt; It&#x27;s one of the most heavily audited codebases on the planet.<p>This is misleading. OpenSSL is probably one of the most heavily audited in terms of number of auditors currently working on it, but this only started with Heartbleed and there appears to be a large, unfinished backlog of things to get through.<p>Looking at <a href="https:&#x2F;&#x2F;www.openssl.org&#x2F;news&#x2F;vulnerabilities.html#y2015" rel="nofollow">https:&#x2F;&#x2F;www.openssl.org&#x2F;news&#x2F;vulnerabilities.html#y2015</a> , since Heartbleed 20 months have passed, and new security vulnerabilities have been announced on 14 separate dates (and most of those dates are multiple vulnerabilities being announced at the same time). This announcement breaks the streak of most consecutive months without a new vulnerability, of which there were almost five.