CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing
Vulnerability summary
CVE-2026-34180 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in openssl. EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63.6% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 28 · Related 20Timeline
- 09-06-2026PublishedVulnerability first disclosed.
- 10-06-2026Last modifiedVulnerability information updated.
Description
Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated. An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer. Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.03%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
Decrease -0.29 pp
From 1.31% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard16 products
- eco-dotnet-libssl-1.0All versions (No fix recorded)
- eco-dotnet-libssl-1.0-ld-so-confAll versions (No fix recorded)
- libcrypto3< 3.6.3-r0
- libcrypto3-2.34< 3.6.3-r0
- openssl< 3.6.3-r0
Ubuntu6 products
- edk2All versions (No fix recorded)
- edk2-hweAll versions (No fix recorded)
- nodejsAll versions (No fix recorded)
- openssl< 1.0.1f-1ubuntu2.27+esm14 | < 1.0.2g-1ubuntu4.20+esm16 | All versions (No fix recorded) | < 1.1.1-1ubuntu2.1~18.04.23+esm9 | < 1.1.1-1ubuntu2.fips.2.1~18.04.23.9 | < 1.1.1f-1ubuntu2.24+esm4 | < 1.1.1f-1ubuntu2.fips.24.4 | < 3.0.2-0ubuntu1.25 | < 3.0.2-0ubuntu1.25+Fips1 | < 3.0.13-0ubuntu3.11 | < 3.5.3-1ubuntu3.4 | < 3.5.5-1ubuntu3.2
- openssl-fipsAll versions (No fix recorded) | < 3.0.13-0ubuntu3.12+Fips1
Wolfi5 products
- libcrypto3< 3.6.3-r0
- openssl< 3.6.3-r0
- openssl-4.0< 4.0.1-r0
- openssl-4.0-libcrypto< 4.0.1-r0
- openssl-4.0-libssl< 4.0.1-r0
Alpine1 product
- openssl≥ 1.0.2, < 3.5.7-r0
Debian1 product
- openssl< 3.0.20-1~deb12u2 | < 3.5.6-1~deb13u2 | < 3.6.3-1
Openssl1 product
- openssl≥ 4.0.0, < 4.0.1 | ≥ 1.0.2, < 1.0.2zq | ≥ 1.1.1, < 1.1.1zh | ≥ 3.0.0, < 3.0.21 | ≥ 3.4.0, < 3.4.6 | ≥ 3.5.0, < 3.5.7 | ≥ 3.6.0, < 3.6.3 | 4.0.0
6 vendors · 30 products
