CVE-2026-58101

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3_EXT_d2i(ext) returns NULL when an extension's DER value fails to parse. basicC, ia5string, and auth_att dereference its result without a NULL check. keyid_data also dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when the parse succeeds. A caller invoking an affected helper on an extension from an untrusted certificate triggers a SIGSEGV that crashes the Perl process.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/dsully/perl-crypt-openssl-x509/commit/4c1e2370556097c253ae27abe9e1097ea377fbd2.patch	Patch
https://metacpan.org/release/JONASBN/Crypt-OpenSSL-X509-2.1.3/source/Changes.md	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:jonasbn:crypt\:\:openssl\:\:x509:*:*:*:*:*:perl:*:*

History

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Crypt::OpenSSL::X509 versiones anteriores a 2.1.3 para Perl permiten la denegación de servicio mediante desreferencia de puntero NULL. X509V3_EXT_d2i(ext) devuelve NULL cuando el valor DER de una extensión no se puede analizar. basicC, ia5string y auth_att desreferencian su resultado sin una comprobación de NULL. keyid_data también desreferencia akid -> keyid, que es NULL para una SECUENCIA AKI vacía (DER 30 00) incluso cuando el análisis tiene éxito. Un llamador que invoca una función auxiliar afectada en una extensión de un certificado no confiable desencadena un SIGSEGV que bloquea el proceso de Perl.

Information

Published : 2026-07-13 23:16

Updated : 2026-10-24 22:10

NVD link : CVE-2026-58101

Mitre link : CVE-2026-58101

CVE.ORG link : CVE-2026-58101

JSON object : View

Products Affected

jonasbn

crypt\

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-58101", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58101", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T12:45:04.507035Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/dsully/perl-crypt-openssl-x509", "vendor": "JONASBN", "product": "Crypt::OpenSSL::X509", "versions": [{"status": "affected", "version": "0", "lessThan": "2.1.3", "versionType": "custom"}], "packageName": "Crypt-OpenSSL-X509", "programFiles": ["X509.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Crypt::OpenSSL::X509::Extension::basicC"}, {"name": "Crypt::OpenSSL::X509::Extension::ia5string"}, {"name": "Crypt::OpenSSL::X509::Extension::auth_att"}, {"name": "Crypt::OpenSSL::X509::Extension::keyid_data"}]}]}], "published": "2026-07-13T23:16:47.020", "references": [{"url": "https://github.com/dsully/perl-crypt-openssl-x509/commit/4c1e2370556097c253ae27abe9e1097ea377fbd2.patch", "tags": ["Patch"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/JONASBN/Crypt-OpenSSL-X509-2.1.3/source/Changes.md", "tags": ["Release Notes"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference.\n\nX509V3_EXT_d2i(ext) returns NULL when an extension's DER value fails to parse. basicC, ia5string, and auth_att dereference its result without a NULL check. keyid_data also dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when the parse succeeds.\n\nA caller invoking an affected helper on an extension from an untrusted certificate triggers a SIGSEGV that crashes the Perl process."}, {"lang": "es", "value": "Crypt::OpenSSL::X509 versiones anteriores a 2.1.3 para Perl permiten la denegaci\u00f3n de servicio mediante desreferencia de puntero NULL.\n\nX509V3_EXT_d2i(ext) devuelve NULL cuando el valor DER de una extensi\u00f3n no se puede analizar. basicC, ia5string y auth_att desreferencian su resultado sin una comprobaci\u00f3n de NULL. keyid_data tambi\u00e9n desreferencia akid -> keyid, que es NULL para una SECUENCIA AKI vac\u00eda (DER 30 00) incluso cuando el an\u00e1lisis tiene \u00e9xito.\n\nUn llamador que invoca una funci\u00f3n auxiliar afectada en una extensi\u00f3n de un certificado no confiable desencadena un SIGSEGV que bloquea el proceso de Perl."}], "lastModified": "2026-10-24T22:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jonasbn:crypt\\:\\:openssl\\:\\:x509:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "D2DF3628-106C-4788-8797-A30E048275AF", "versionEndExcluding": "2.1.3"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}