Picotls is a TLS protocol library that supports multiple crypto backends. The minicrypto backend uses picotls's own ASN.1 validation helper to parse local PKCS#8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c7, this validator did not enforce a maximum nesting depth when recursively descending constructed ASN.1 elements. An attacker can supply a crafted deeply nested ASN.1 structure that causes the validator to exhaust the process stack, resulting in an infinite loop and application crash. The OpenSSL backend does not use this helper and is unaffected. The vulnerability is addressed by the referenced commit.

An attacker who can supply a maliciously crafted private key file or ASN.1 DER data to the vulnerable picotls minicrypto backend can cause the application to crash due to stack exhaustion from an infinite loop. This results in a denial of service condition. There is no impact on confidentiality or integrity. The OpenSSL backend is not vulnerable.

The vulnerability has been fixed in commit c14231d801407640bc42c2dcf92783409ea6a7c7. However, no explicit patch or fixed version is provided in the available data. Users should update to a version that includes this commit once available. Until then, avoid loading untrusted ASN.1 data with the minicrypto backend. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.