CVE-2026-58102: CWE-125 Out-of-bounds Read in JONASBN Crypt::OpenSSL::X509
Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_exts. When building the extension hash (via extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_oid()), the code passes OBJ_obj2txt()'s return value as the hash-key length; because that value is the OID's full text length rather than the bytes written to the fixed-size buffer (129 bytes), an OID whose text is longer than the 129-byte buffer causes a read past the allocation, exposing adjacent heap memory as the returned hash key. extensions_by_name() uses the static shortname path and is not affected.
AI Analysis
Technical Summary
CVE-2026-58102 is a heap out-of-bounds read vulnerability in Crypt::OpenSSL::X509 versions prior to 2.1.3. The flaw occurs when processing certificate extension OIDs longer than 129 bytes. The code incorrectly uses the full OID text length returned by OBJ_obj2txt() as the hash key length, leading to reading beyond the fixed-size buffer and exposing adjacent heap memory. This affects the extensions(), extensions_by_long_name(), extensions_by_oid(), and has_extension_oid() functions. The extensions_by_name() function is not vulnerable as it uses a different code path.
Potential Impact
This vulnerability can lead to disclosure of adjacent heap memory contents due to out-of-bounds reads when handling long certificate extension OIDs. There is no indication of code execution or other impacts. No known exploits are reported in the wild. The exposure of heap memory could potentially leak sensitive information depending on the context in which the library is used.
Mitigation Recommendations
No official fix or patch is currently confirmed. Users should upgrade to Crypt::OpenSSL::X509 version 2.1.3 or later once available. Until then, avoid processing certificates with unusually long extension OIDs or use the extensions_by_name() function which is not affected. Monitor the vendor advisory for updates on remediation.
CVE-2026-58102: CWE-125 Out-of-bounds Read in JONASBN Crypt::OpenSSL::X509
Description
Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_exts. When building the extension hash (via extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_oid()), the code passes OBJ_obj2txt()'s return value as the hash-key length; because that value is the OID's full text length rather than the bytes written to the fixed-size buffer (129 bytes), an OID whose text is longer than the 129-byte buffer causes a read past the allocation, exposing adjacent heap memory as the returned hash key. extensions_by_name() uses the static shortname path and is not affected.
CVSS v3.1
Score 9.1critical
Affected software
pkg:github/Crypt-OpenSSL-X509Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-58102 is a heap out-of-bounds read vulnerability in Crypt::OpenSSL::X509 versions prior to 2.1.3. The flaw occurs when processing certificate extension OIDs longer than 129 bytes. The code incorrectly uses the full OID text length returned by OBJ_obj2txt() as the hash key length, leading to reading beyond the fixed-size buffer and exposing adjacent heap memory. This affects the extensions(), extensions_by_long_name(), extensions_by_oid(), and has_extension_oid() functions. The extensions_by_name() function is not vulnerable as it uses a different code path.
Potential Impact
This vulnerability can lead to disclosure of adjacent heap memory contents due to out-of-bounds reads when handling long certificate extension OIDs. There is no indication of code execution or other impacts. No known exploits are reported in the wild. The exposure of heap memory could potentially leak sensitive information depending on the context in which the library is used.
Mitigation Recommendations
No official fix or patch is currently confirmed. Users should upgrade to Crypt::OpenSSL::X509 version 2.1.3 or later once available. Until then, avoid processing certificates with unusually long extension OIDs or use the extensions_by_name() function which is not affected. Monitor the vendor advisory for updates on remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-06-29T06:35:04.718Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5567a468715ace43fd6a49
Added to database: 07/13/2026, 22:33:08 UTC
Last enriched: 07/13/2026, 22:47:28 UTC
Last updated: 08/27/2026, 22:52:12 UTC
Views: 95
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.