I found an OpenSSL bug that was assigned CVE-2015-0208 and it is still embargoed near as I can tell.