CVE-2026-58101: Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference
Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference.
X509V3EXTd2i(ext) returns NULL when an extension's DER value fails to parse. basicC, ia5string, and authatt dereference its result without a NULL check. keyiddata also dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when the parse succeeds.
A caller invoking an affected helper on an extension from an untrusted certificate triggers a SIGSEGV that crashes the Perl process.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58101?
CVE-2026-58101 is classified with a risk score of 23, indicating a potentially significant impact on system availability.
How do I fix CVE-2026-58101?
To fix CVE-2026-58101, upgrade Crypt::OpenSSL::X509 to version 2.1.3 or later.
What impact does CVE-2026-58101 have on systems using OpenSSL?
CVE-2026-58101 can lead to a denial of service due to a NULL pointer dereference in affected versions.
Which versions of Crypt::OpenSSL::X509 are affected by CVE-2026-58101?
CVE-2026-58101 affects all versions of Crypt::OpenSSL::X509 prior to 2.1.3.
Is CVE-2026-58101 a remote vulnerability?
CVE-2026-58101 may lead to denial of service through specific inputs, making it a remote vulnerability.