Executive brief
Crypt::OpenSSL::X509 is a Perl library used to process digital certificates. A security flaw in how it handles certificate extensions allows a specially crafted certificate to expose small amounts of private memory from the application's memory pool. This could potentially leak sensitive information to an attacker who provides a malicious certificate for processing.
Technical details
A heap out-of-bounds read exists in the hv_exts() function of Crypt::OpenSSL::X509. The vulnerability occurs because the code uses a fixed 129-byte buffer for extension OIDs but passes the full length returned by OBJ_obj2txt() to hv_store() as the hash key length. If an OID's textual representation exceeds 128 bytes, hv_store() reads past the allocated buffer, exposing adjacent heap memory. This affects methods including extensions(), extensions_by_long_name(), and extensions_by_oid(). The issue is resolved in version 2.1.3 by implementing a two-phase OBJ_obj2txt() call to properly size the buffer.
Affected products
- JONASBN Crypt::OpenSSL::X509 before 2.1.3
Timeline
- 2026-07-11: patched: Fix committed to GitHub repository.
- 2026-07-12: advisory: Release 2.1.3 published on CPAN.
- 2026-07-13: disclosed: CVE published to NVD.