CVE-2026-58101 Details
Description
Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3_EXT_d2i(ext) returns NULL when an extension's DER value fails to parse. basicC, ia5string, and auth_att dereference its result without a NULL check. keyid_data also dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when the parse succeeds. A caller invoking an affected helper on an extension from an untrusted certificate triggers a SIGSEGV that crashes the Perl process.
A denial-of-service vulnerability has been identified in Crypt::OpenSSL::X509 versions prior to 2.1.3 for Perl. The issue arises from a NULL pointer dereference in several extension helper functions, which can be exploited by passing an untrusted certificate. When the DER value of an extension fails to parse, the X509V3_EXT_d2i function returns NULL. However, basicC, ia5string, auth_att, and keyid_data helpers dereference this result without checking for NULL. This flaw can lead to a segmentation fault, crashing the Perl process.
Users are advised to update to Crypt::OpenSSL::X509 version 2.1.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dsully/perl-crypt-openssl-x509/commit/4c1e2370556097c253ae27abe9e1097ea377fbd2.patch | CPANSec | Patch |
| https://metacpan.org/release/JONASBN/Crypt-OpenSSL-X509-2.1.3/source/Changes.md | CPANSec | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| jonasbn crypt::openssl::x509 | < 2.1.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | CPANSec |