The vulnerability in Crypt::OpenSSL::X509 (prior to version 2.1.3) involves a heap out-of-bounds read caused by improper handling of long certificate extension OIDs in the hv_exts hash. Specifically, when building the extension hash via extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_oid(), the code passes the length of the OID's full text as the hash key length instead of the actual bytes written to the fixed-size buffer (129 bytes). If the OID text length exceeds 129 bytes, this results in reading adjacent heap memory beyond the buffer, exposing potentially sensitive data. The extensions_by_name() function, which uses short names, is not affected by this issue.

This vulnerability allows an attacker to cause a heap out-of-bounds read, potentially exposing adjacent heap memory contents. According to the CVSS vector, the impact is a high confidentiality impact (C:H) and high availability impact (A:H), with no impact on integrity (I:N). The vulnerability is remotely exploitable without privileges or user interaction. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing certificates with unusually long extension OIDs using the affected functions. Using extensions_by_name(), which is not affected, may be a temporary workaround. Monitor vendor channels for updates and apply patches promptly once released.