CVE-2026-58101highCWE-476

CVE-2026-58101: high-severity vulnerability in JONASBN Crypt::OpenSSL::X509

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference

Published · Updated

Follow this CVE+ Monitor Crypt::OpenSSL::X509+ Monitor perl-crypt-openssl-x509

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.3%
Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3_EXT_d2i(ext) returns NULL when an extension's DER value fails to parse. basicC, ia5string, and auth_att dereference its result without a NULL check. keyid_data also dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when the parse succeeds. A caller invoking an affected helper on an extension from an untrusted certificate triggers a SIGSEGV that crashes the Perl process.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
JONASBN · Crypt::OpenSSL::X509
Related CVEs — JONASBN Crypt::OpenSSL::X509

In the same product, most dangerous first.

CVE-2026-58102CRITICALCrypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_extsEPSS 0.3%