Executive brief
OpenSSL is a widely used security library that provides encryption and secure communication for websites and applications. A flaw in how it handles digital timestamp responses could allow an attacker to crash an application that uses this specific feature. While this results in a service outage (Denial of Service), it does not appear to allow for data theft or unauthorized access.
Technical details
A type confusion vulnerability exists in the OpenSSL TimeStamp Response verification code within the functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2(). The root cause is the lack of type validation for the signing certificate attribute value before accessing it as an ASN1_TYPE union member. If the attribute type is not V_ASN1_SEQUENCE, the application attempts to access invalid memory, leading to a NULL or invalid pointer dereference and a subsequent crash. An attacker can trigger this by providing a malformed TimeStamp Response (RFC 3161) to an application calling TS_RESP_verify_response(). Patches have been released for affected versions including 3.0 through 3.6 and 1.1.1.
Affected products
- OpenSSL OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1
Timeline
- 2026-01-27: disclosed
- 2026-01-27: advisory
- 2026-01-26: patched: Commits applied to various branches.
References
- https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9
- https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a
- https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e
- https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b
- https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085
- https://openssl-library.org/news/secadv/20260127.txt
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html