Junglewise Threat Intelligence

CVE-2026-58101: Crypt::OpenSSL::X509 NULL pointer dereference in extension helpers

CVE-2026-58101 · Severity: info · CVSS 7.5 · Published 2026-07-13

Executive brief

A vulnerability in a Perl library used for processing security certificates can allow an attacker to crash applications that use it. By providing a specially crafted or malformed digital certificate, an attacker can cause the software to stop responding or shut down unexpectedly. This results in a denial of service, potentially disrupting secure communications or authentication processes.

Technical details

A NULL pointer dereference exists in the Crypt::OpenSSL::X509 Perl module within several extension helper functions, including basicC(), ia5string(), auth_att(), and keyid_data(). The root cause is a failure to validate the return value of the OpenSSL X509V3_EXT_d2i() function, which returns NULL if an extension's DER value is malformed. Additionally, the keyid_data() function fails to check if the optional keyid field in an Authority Key Identifier (AKI) is NULL. An unauthenticated remote attacker can exploit this by providing a certificate with malformed extensions or specific AKI structures, triggering a SIGSEGV and crashing the Perl process. The issue is resolved in version 2.1.3.

Affected products

  • JONASBN Crypt::OpenSSL::X509 < 2.1.3

Timeline

  • 2026-07-11: patched: Fix committed to GitHub repository.
  • 2026-07-12: other: Version 2.1.3 released on CPAN.
  • 2026-07-13: disclosed: CVE-2026-58101 published.

References

Related threats