SECUFOCUSNOW
Home›CVE index›CVE-2026-34180
Review reviewHigh

CVE-2026-34180

OpenSSL OpenSSL, openssl

Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated. An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigaby...

CVSS
7.5
EPSS
1.03%
60.2% percentile
CISA KEV
Not listed
Published
2026.06.10
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability1.03%
Technical severityCVSS 7.5

Vulnerability overview

Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated. An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigaby...

Affected product and versions

Product
OpenSSL OpenSSL, openssl
Affected versions
>= 4.0.0 < 4.0.1, >= 3.6.0 < 3.6.3, >= 3.5.0 < 3.5.7, >= 3.4.0 < 3.4.6, >= 3.0.0 < 3.0.21, >= 1.1.1 < 1.1.1zh, >= 1.0.2 < 1.0.2zq, 4.0.0
Fixed versions
1.0.2zq, 1.1.1zh, 3.0.21, 3.4.6, 3.5.7, 3.6.3

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that OpenSSL OpenSSL, openssl and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
CWE-125
CVE-2026-34180 — OpenSSL OpenSSL, openssl | SECUFOCUS NOW