CVE-2026-58101

{
  "id": "CVE-2026-58101",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-07-13T23:16:47.020",
  "lastModified": "2026-10-24T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference.\n\nX509V3_EXT_d2i(ext) returns NULL when an extension's DER value fails to parse. basicC, ia5string, and auth_att dereference its result without a NULL check. keyid_data also dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when the parse succeeds.\n\nA caller invoking an affected helper on an extension from an untrusted certificate triggers a SIGSEGV that crashes the Perl process."
    },
    {
      "lang": "es",
      "value": "Crypt::OpenSSL::X509 versiones anteriores a 2.1.3 para Perl permiten la denegación de servicio mediante desreferencia de puntero NULL.\n\nX509V3_EXT_d2i(ext) devuelve NULL cuando el valor DER de una extensión no se puede analizar. basicC, ia5string y auth_att desreferencian su resultado sin una comprobación de NULL. keyid_data también desreferencia akid  ->  keyid, que es NULL para una SECUENCIA AKI vacía (DER 30 00) incluso cuando el análisis tiene éxito.\n\nUn llamador que invoca una función auxiliar afectada en una extensión de un certificado no confiable desencadena un SIGSEGV que bloquea el proceso de Perl."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "JONASBN",
          "product": "Crypt::OpenSSL::X509",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Crypt-OpenSSL-X509",
          "programFiles": [
            "X509.xs"
          ],
          "programRoutines": [
            {
              "name": "Crypt::OpenSSL::X509::Extension::basicC"
            },
            {
              "name": "Crypt::OpenSSL::X509::Extension::ia5string"
            },
            {
              "name": "Crypt::OpenSSL::X509::Extension::auth_att"
            },
            {
              "name": "Crypt::OpenSSL::X509::Extension::keyid_data"
            }
          ],
          "repo": "https://github.com/dsully/perl-crypt-openssl-x509",
          "versions": [
            {
              "version": "0",
              "lessThan": "2.1.3",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-14T12:45:04.507035Z",
          "id": "CVE-2026-58101",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:jonasbn:crypt\\:\\:openssl\\:\\:x509:*:*:*:*:*:perl:*:*",
              "versionEndExcluding": "2.1.3",
              "matchCriteriaId": "D2DF3628-106C-4788-8797-A30E048275AF"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/dsully/perl-crypt-openssl-x509/commit/4c1e2370556097c253ae27abe9e1097ea377fbd2.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://metacpan.org/release/JONASBN/Crypt-OpenSSL-X509-2.1.3/source/Changes.md",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Release Notes"
      ]
    }
  ]
}