CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing
Heap Buffer Over-read in ASN.1 Content Parsing
Other sources
Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 3.0.20-1~deb12u2Fixed in 3.5.6-1~deb13u2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20240524git3e722403cd16-18 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.7-3 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 1.0.2zq - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 1.1.1zh - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 3.0.21 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 3.4.6 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 3.5.7 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 3.6.3 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 4.0.1 - Compensating control
If using OpenSSL command-line tools, note they are not vulnerable because data read through the BIO layer is checked before it reaches the affected code; use those paths where feasible instead of direct calls into the affected ASN.1 d2i_* decoding code.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34180?
The severity of CVE-2026-34180 is rated high with a CVSS score of 7.5.
How do I fix CVE-2026-34180?
To address CVE-2026-34180, upgrade to the latest version of OpenSSL that includes the patch for this vulnerability.
What systems are affected by CVE-2026-34180?
CVE-2026-34180 affects 64-bit Unix and Unix-like platforms running vulnerable versions of OpenSSL.
What is the nature of CVE-2026-34180?
CVE-2026-34180 is a heap buffer over-read vulnerability that occurs during ASN.1 content parsing.
Can CVE-2026-34180 result in data loss?
Yes, CVE-2026-34180 has the potential to cause an application crash, leading to data loss.