CVE-2026-58102 Details
Description
Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_exts. When building the extension hash (via extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_oid()), the code passes OBJ_obj2txt()'s return value as the hash-key length; because that value is the OID's full text length rather than the bytes written to the fixed-size buffer (129 bytes), an OID whose text is longer than the 129-byte buffer causes a read past the allocation, exposing adjacent heap memory as the returned hash key. extensions_by_name() uses the static shortname path and is not affected.
A heap out-of-bounds read vulnerability has been identified in Crypt::OpenSSL::X509 versions prior to 2.1.3 for Perl. The issue arises in the 'hv_exts' function when processing certificate extensions with long OID strings. The function allocates a fixed-size buffer of 128 bytes but incorrectly uses the full length of the OID text as the key length for storing in a hash. This mismatch allows OIDs longer than 128 bytes to cause a read beyond the allocated memory, exposing adjacent heap data. The vulnerability can be triggered by certificates containing such long OIDs in their extensions.
Users are advised to update to Crypt::OpenSSL::X509 version 2.1.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dsully/perl-crypt-openssl-x509/commit/757289bfce095455c104d4adfe9312e7b339620f.patch | CPANSec | Patch |
| https://metacpan.org/release/JONASBN/Crypt-OpenSSL-X509-2.1.3/source/Changes.md | CPANSec | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| jonasbn crypt::openssl::x509 | < 2.1.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | CPANSec |