CVE-2026-58101

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58101", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-06-29T06:35:04.717Z", "datePublished": "2026-07-13T22:17:48.375Z", "dateUpdated": "2026-07-14T12:45:11.194Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Crypt-OpenSSL-X509", "product": "Crypt::OpenSSL::X509", "programFiles": ["X509.xs"], "programRoutines": [{"name": "Crypt::OpenSSL::X509::Extension::basicC"}, {"name": "Crypt::OpenSSL::X509::Extension::ia5string"}, {"name": "Crypt::OpenSSL::X509::Extension::auth_att"}, {"name": "Crypt::OpenSSL::X509::Extension::keyid_data"}], "repo": "https://github.com/dsully/perl-crypt-openssl-x509", "vendor": "JONASBN", "versions": [{"lessThan": "2.1.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference.\n\nX509V3_EXT_d2i(ext) returns NULL when an extension's DER value fails to parse. basicC, ia5string, and auth_att dereference its result without a NULL check. keyid_data also dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when the parse succeeds.\n\nA caller invoking an affected helper on an extension from an untrusted certificate triggers a SIGSEGV that crashes the Perl process."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-13T22:17:48.375Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/dsully/perl-crypt-openssl-x509/commit/4c1e2370556097c253ae27abe9e1097ea377fbd2.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/JONASBN/Crypt-OpenSSL-X509-2.1.3/source/Changes.md"}], "solutions": [{"lang": "en", "value": "Upgrade to Crypt::OpenSSL::X509 2.1.3 or later, which NULL-checks each X509V3_EXT_d2i result and the optional keyid field before dereferencing."}], "source": {"discovery": "UNKNOWN"}, "title": "Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T12:45:04.507035Z", "id": "CVE-2026-58101", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T12:45:11.194Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/dsully/perl-crypt-openssl-x509", "vendor": "JONASBN", "product": "Crypt::OpenSSL::X509", "versions": [{"status": "affected", "version": "0", "lessThan": "2.1.3", "versionType": "custom"}], "packageName": "Crypt-OpenSSL-X509", "programFiles": ["X509.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Crypt::OpenSSL::X509::Extension::basicC"}, {"name": "Crypt::OpenSSL::X509::Extension::ia5string"}, {"name": "Crypt::OpenSSL::X509::Extension::auth_att"}, {"name": "Crypt::OpenSSL::X509::Extension::keyid_data"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Crypt::OpenSSL::X509 2.1.3 or later, which NULL-checks each X509V3_EXT_d2i result and the optional keyid field before dereferencing."}], "references": [{"url": "https://github.com/dsully/perl-crypt-openssl-x509/commit/4c1e2370556097c253ae27abe9e1097ea377fbd2.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/JONASBN/Crypt-OpenSSL-X509-2.1.3/source/Changes.md", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference.\n\nX509V3_EXT_d2i(ext) returns NULL when an extension's DER value fails to parse. basicC, ia5string, and auth_att dereference its result without a NULL check. keyid_data also dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when the parse succeeds.\n\nA caller invoking an affected helper on an extension from an untrusted certificate triggers a SIGSEGV that crashes the Perl process."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-13T22:17:48.375Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-58101", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T12:45:04.507035Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-07-14T12:44:58.448Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-58101", "state": "PUBLISHED", "dateUpdated": "2026-07-13T22:17:48.375Z", "dateReserved": "2026-06-29T06:35:04.717Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-07-13T22:17:48.375Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Crypt-OpenSSL-X509", "product": "Crypt::OpenSSL::X509", "programFiles": ["X509.xs"], "programRoutines": [{"name": "Crypt::OpenSSL::X509::Extension::basicC"}, {"name": "Crypt::OpenSSL::X509::Extension::ia5string"}, {"name": "Crypt::OpenSSL::X509::Extension::auth_att"}, {"name": "Crypt::OpenSSL::X509::Extension::keyid_data"}], "repo": "https://github.com/dsully/perl-crypt-openssl-x509", "vendor": "JONASBN", "versions": [{"lessThan": "2.1.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jonasbn:crypt\\:\\:openssl\\:\\:x509:*:*:*:*:*:perl:*:*", "matchCriteriaId": "D2DF3628-106C-4788-8797-A30E048275AF", "versionEndExcluding": "2.1.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference.\n\nX509V3_EXT_d2i(ext) returns NULL when an extension's DER value fails to parse. basicC, ia5string, and auth_att dereference its result without a NULL check. keyid_data also dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when the parse succeeds.\n\nA caller invoking an affected helper on an extension from an untrusted certificate triggers a SIGSEGV that crashes the Perl process."}, {"lang": "es", "value": "Crypt::OpenSSL::X509 versiones anteriores a 2.1.3 para Perl permiten la denegaci\u00f3n de servicio mediante desreferencia de puntero NULL.\n\nX509V3_EXT_d2i(ext) devuelve NULL cuando el valor DER de una extensi\u00f3n no se puede analizar. basicC, ia5string y auth_att desreferencian su resultado sin una comprobaci\u00f3n de NULL. keyid_data tambi\u00e9n desreferencia akid -> keyid, que es NULL para una SECUENCIA AKI vac\u00eda (DER 30 00) incluso cuando el an\u00e1lisis tiene \u00e9xito.\n\nUn llamador que invoca una funci\u00f3n auxiliar afectada en una extensi\u00f3n de un certificado no confiable desencadena un SIGSEGV que bloquea el proceso de Perl."}], "id": "CVE-2026-58101", "lastModified": "2026-10-24T22:10:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58101", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T12:45:04.507035Z", "version": "2.0.3"}}]}, "published": "2026-07-13T23:16:47.020", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Patch"], "url": "https://github.com/dsully/perl-crypt-openssl-x509/commit/4c1e2370556097c253ae27abe9e1097ea377fbd2.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Release Notes"], "url": "https://metacpan.org/release/JONASBN/Crypt-OpenSSL-X509-2.1.3/source/Changes.md"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"created": "2026-07-14T13:00:04.574044+00:00", "updated": "2026-07-31T11:15:05.504653+00:00", "vendors": []}