JONASBN Crypt::OpenSSL::X509 up to 2.1.2 Extension oid out-of-bounds

Summaryinfo

A vulnerability was found in JONASBN Crypt::OpenSSL::X509 up to 2.1.2. It has been classified as problematic. Affected is the function extensions/extensions_by_long_name/extensions_by_oid/has_extension_oid of the component Extension. Performing a manipulation of the argument oid results in out-of-bounds. This vulnerability is identified as CVE-2026-58102. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in JONASBN Crypt::OpenSSL::X509 up to 2.1.2. This affects the function extensions/extensions_by_long_name/extensions_by_oid/has_extension_oid of the component Extension. The manipulation of the argument oid with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality. The summary by CVE is:

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_exts. When building the extension hash (via extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_oid()), the code passes OBJ_obj2txt()'s return value as the hash-key length; because that value is the OID's full text length rather than the bytes written to the fixed-size buffer (129 bytes), an OID whose text is longer than the 129-byte buffer causes a read past the allocation, exposing adjacent heap memory as the returned hash key. extensions_by_name() uses the static shortname path and is not affected.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-58102 since 06/29/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 2.1.3 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Network Encryption Software

Vendor

• JONASBN

Name

• Crypt::OpenSSL::X509

Version

• 2.1.0
• 2.1.1
• 2.1.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion