Executive brief
OpenSSL is a widely used security library that helps protect internet communications and verify digital identities. A flaw in how it handles email address validation during security checks (like S/MIME email verification) could allow an attacker to send a specially crafted email that causes the application to crash. This results in a denial of service, potentially disrupting email processing or other secure communication services.
Technical details
An out-of-bounds read vulnerability exists in OpenSSL's internal helper functions called by X509_VERIFY_PARAM_set1_email() and X509_VERIFY_PARAM_add_email(). The root cause is the use of an incorrect length value when validating the local part of an email address, failing to enforce the 64-octet limit. An attacker can exploit this by providing a crafted 'From:' address in an S/MIME message. While the vulnerability is unlikely to lead to data exfiltration, it can trigger a memory access violation resulting in a process crash (Denial of Service). The FIPS module is not affected as the vulnerable code resides outside the FIPS boundary.
Affected products
- OpenSSL OpenSSL All versions using X509_VERIFY_PARAM_set1_email
Timeline
- 2026-06-09: disclosed: Vulnerability published by OpenSSL and NVD