Executive brief
OpenSSL is a widely used security library that enables encrypted communications for websites and applications. A vulnerability in how it processes certain large data structures could allow an attacker to crash a service or potentially access sensitive information from the system's memory. This issue specifically affects 64-bit Unix-like systems when processing data larger than 2 gigabytes.
Technical details
An integer truncation vulnerability exists in OpenSSL's ASN.1 decoder when processing primitive elements with content lengths exceeding 2GB. On 64-bit Unix and Unix-like platforms, this truncation causes the decoder to mishandle the length, potentially treating it as a request to scan for a terminating zero byte. This can result in a heap buffer over-read. Attackers can exploit this by providing crafted DER-encoded data to functions such as d2i_X509() or d2i_PKCS7(). The impact includes application crashes (DoS) or the leakage of adjacent memory contents into the decoded object. 32-bit platforms and 64-bit Windows are not affected.
Affected products
- OpenSSL Foundation OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, 1.0.2
Timeline
- 2026-06-09: advisory: Advisory published by OpenSSL Foundation
References
- https://github.com/openssl/security/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d
- https://github.com/openssl/security/commit/cbe418ae978539cf14a398a207dba834c0e93e83
- https://github.com/openssl/security/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff
- https://github.com/openssl/security/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43
- https://github.com/openssl/security/commit/f696c73c3e61b8c502d040af62e690c060908a16
- https://openssl-library.org/news/secadv/20260609.txt