CVE-2026-45271

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45271", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-11T18:41:13.156Z", "datePublished": "2026-08-21T21:00:46.759Z", "dateUpdated": "2026-08-25T14:18:28.158Z"}, "containers": {"cna": {"title": "picotls has infinite recursion in the minicrypto ASN.1 decoder", "problemTypes": [{"descriptions": [{"cweId": "CWE-835", "lang": "en", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/h2o/picotls/security/advisories/GHSA-84f5-m5x2-82q4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/h2o/picotls/security/advisories/GHSA-84f5-m5x2-82q4"}, {"name": "https://github.com/h2o/picotls/commit/c14231d801407640bc42c2dcf92783409ea6a7c7", "tags": ["x_refsource_MISC"], "url": "https://github.com/h2o/picotls/commit/c14231d801407640bc42c2dcf92783409ea6a7c7"}], "affected": [{"vendor": "h2o", "product": "picotls", "versions": [{"version": "< c14231d801407640bc42c2dcf92783409ea6a7c7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T21:00:46.759Z"}, "descriptions": [{"lang": "en", "value": "Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS#8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c7, the validator recursively descends into constructed ASN.1 elements without enforcing a maximum nesting depth. If an application loads an attacker-supplied private-key file through ptls_minicrypto_load_private_key(), or otherwise calls the public ASN.1 validation API on untrusted DER, a crafted deeply nested ASN.1 structure can exhaust the process stack and crash the application. Note that the libcrypto (OpenSSL) backend does not use the ASN.1 validation helper of picotls, and therefore is immune to this vulnerability. The vulnerability has been addressed in commit c14231d801407640bc42c2dcf92783409ea6a7c7."}], "source": {"advisory": "GHSA-84f5-m5x2-82q4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T14:18:20.428853Z", "id": "CVE-2026-45271", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T14:18:28.158Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45271", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T14:18:20.428853Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T14:18:24.596Z"}}], "cna": {"title": "picotls has infinite recursion in the minicrypto ASN.1 decoder", "source": {"advisory": "GHSA-84f5-m5x2-82q4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "h2o", "product": "picotls", "versions": [{"status": "affected", "version": "< c14231d801407640bc42c2dcf92783409ea6a7c7"}]}], "references": [{"url": "https://github.com/h2o/picotls/security/advisories/GHSA-84f5-m5x2-82q4", "name": "https://github.com/h2o/picotls/security/advisories/GHSA-84f5-m5x2-82q4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/h2o/picotls/commit/c14231d801407640bc42c2dcf92783409ea6a7c7", "name": "https://github.com/h2o/picotls/commit/c14231d801407640bc42c2dcf92783409ea6a7c7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS#8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c7, the validator recursively descends into constructed ASN.1 elements without enforcing a maximum nesting depth. If an application loads an attacker-supplied private-key file through ptls_minicrypto_load_private_key(), or otherwise calls the public ASN.1 validation API on untrusted DER, a crafted deeply nested ASN.1 structure can exhaust the process stack and crash the application. Note that the libcrypto (OpenSSL) backend does not use the ASN.1 validation helper of picotls, and therefore is immune to this vulnerability. The vulnerability has been addressed in commit c14231d801407640bc42c2dcf92783409ea6a7c7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T21:00:46.759Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45271", "state": "PUBLISHED", "dateUpdated": "2026-08-25T14:18:28.158Z", "dateReserved": "2026-05-11T18:41:13.156Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-21T21:00:46.759Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "picotls", "vendor": "h2o", "versions": [{"status": "affected", "version": "< c14231d801407640bc42c2dcf92783409ea6a7c7"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS#8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c7, the validator recursively descends into constructed ASN.1 elements without enforcing a maximum nesting depth. If an application loads an attacker-supplied private-key file through ptls_minicrypto_load_private_key(), or otherwise calls the public ASN.1 validation API on untrusted DER, a crafted deeply nested ASN.1 structure can exhaust the process stack and crash the application. Note that the libcrypto (OpenSSL) backend does not use the ASN.1 validation helper of picotls, and therefore is immune to this vulnerability. The vulnerability has been addressed in commit c14231d801407640bc42c2dcf92783409ea6a7c7."}, {"lang": "es", "value": "Picotls es una biblioteca de protocolo TLS que permite a los usuarios seleccionar diferentes backends criptogr\u00e1ficos seg\u00fan su caso de uso. Picotls implementa su propio asistente de validaci\u00f3n ASN.1, que es utilizado por el backend minicrypto al analizar claves privadas PKCS#8 locales. Antes del commit c14231d801407640bc42c2dcf92783409ea6a7c7, el validador desciende recursivamente en elementos ASN.1 construidos sin imponer una profundidad m\u00e1xima de anidamiento. Si una aplicaci\u00f3n carga un archivo de clave privada suministrado por un atacante a trav\u00e9s de ptls_minicrypto_load_private_key(), o de otro modo llama a la API p\u00fablica de validaci\u00f3n ASN.1 en DER no confiable, una estructura ASN.1 profundamente anidada y manipulada puede agotar la pila del proceso y bloquear la aplicaci\u00f3n. Tenga en cuenta que el backend libcrypto (OpenSSL) no utiliza el asistente de validaci\u00f3n ASN.1 de picotls y, por lo tanto, es inmune a esta vulnerabilidad. La vulnerabilidad ha sido abordada en el commit c14231d801407640bc42c2dcf92783409ea6a7c7."}], "id": "CVE-2026-45271", "lastModified": "2026-10-12T16:10:00.220", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45271", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T14:18:20.428853Z", "version": "2.0.3"}}]}, "published": "2026-08-21T21:16:59.547", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/h2o/picotls/commit/c14231d801407640bc42c2dcf92783409ea6a7c7"}, {"source": "security-advisories@github.com", "url": "https://github.com/h2o/picotls/security/advisories/GHSA-84f5-m5x2-82q4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,<c14231d801407640bc42c2dcf92783409ea6a7c7)"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "picotls", "source": "cna", "vendor": "h2o"}, "product": "picotis", "vendor": "h20"}], "created": "2026-08-21T23:00:14.781794+00:00", "updated": "2026-08-24T21:00:12.183943+00:00", "vendors": ["h20", "h20$PRODUCT$picotis"]}