« Volver al listado

CVE-2026-34180

Estado: AnalizadaAlta (7.5)—

Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms.

Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated.

An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes.

Leer descripción completaMostrar menos

In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer.

Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de acceso remoto sin autenticación ni interacción (AV:N/PR:N/UI:N) en OpenSSL que causa denegación de servicio mediante crash de aplicaciones procesando datos DER-ASN.1 malformados.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Openssl — Openssl

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-34180",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-34180",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-09T19:00:59.503895Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "openssl-security@openssl.org",
      "affectedData": [
        {
          "vendor": "OpenSSL",
          "product": "OpenSSL",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "4.0.1",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.6.0",
              "lessThan": "3.6.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.5.0",
              "lessThan": "3.5.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.4.0",
              "lessThan": "3.4.6",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.0.0",
              "lessThan": "3.0.21",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.1.1",
              "lessThan": "1.1.1zh",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "1.0.2",
              "lessThan": "1.0.2zq",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-09T17:17:04.600",
  "references": [
    {
      "url": "https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d",
      "tags": [
        "Patch"
      ],
      "source": "openssl-security@openssl.org"
    },
    {
      "url": "https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83",
      "tags": [
        "Patch"
      ],
      "source": "openssl-security@openssl.org"
    },
    {
      "url": "https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff",
      "tags": [
        "Patch"
      ],
      "source": "openssl-security@openssl.org"
    },
    {
      "url": "https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43",
      "tags": [
        "Patch"
      ],
      "source": "openssl-security@openssl.org"
    },
    {
      "url": "https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16",
      "tags": [
        "Patch"
      ],
      "source": "openssl-security@openssl.org"
    },
    {
      "url": "https://openssl-library.org/news/secadv/20260609.txt",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "openssl-security@openssl.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "openssl-security@openssl.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer.  More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL's ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\nworst case the truncated length is treated as a request to scan the binary\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\nless than or beyond the end of the allocated buffer.\n\nApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\nany other d2i_* decoding function are affected. OpenSSL's own command-line\ntools are not vulnerable, as data read through the BIO layer is checked before\nit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\nplatforms; 32-bit platforms and 64-bit Windows are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."
    },
    {
      "lang": "es",
      "value": "Resumen del problema: Analizar una estructura ASN.1 codificada en DER manipulada con un elemento primitivo cuyo contenido excede los 2 gigabytes de longitud puede causar una lectura excesiva del búfer de la pila (heap buffer over-read) en plataformas Unix y similares a Unix de 64 bits.\n\nResumen del impacto: La lectura excesiva del búfer de la pila puede bloquear la aplicación (Denegación de Servicio) o cargar en el objeto ASN.1 decodificado contenidos de memoria más allá del final del búfer de entrada. Más típicamente, tales elementos ASN.1 serían truncados en su lugar.\n\nUn truncamiento de entero en el decodificador ASN.1 de OpenSSL hace que la longitud del contenido de un elemento primitivo ASN.1 sea manejada incorrectamente cuando excede los 2 gigabytes. En el peor de los casos, la longitud truncada se trata como una solicitud para escanear el contenido binario en busca de un byte cero de terminación, posiblemente causando que OpenSSL lea menos o más allá del final del búfer asignado.\n\nLas aplicaciones que pasan datos suministrados por el atacante a d2i_X509(), d2i_PKCS7(), o cualquier otra función de decodificación d2i_* se ven afectadas. Las propias herramientas de línea de comandos de OpenSSL no son vulnerables, ya que los datos leídos a través de la capa BIO se verifican antes de que lleguen al código afectado. El problema solo afecta a plataformas Unix y similares a Unix de 64 bits; las plataformas de 32 bits y Windows de 64 bits no se ven afectadas.\n\nLos módulos FIPS en 4.0, 3.6, 3.5, 3.4 y 3.0 no se ven afectados por este problema, ya que el código afectado está fuera del límite del módulo FIPS de OpenSSL."
    }
  ],
  "lastModified": "2026-07-23T08:10:00.137",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F534B804-67B6-49DA-8A86-0FF21E512908",
              "versionEndExcluding": "1.0.2zq",
              "versionStartIncluding": "1.0.2"
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43EFE1E3-4049-4EE6-A2AE-BDBA38E6870F",
              "versionEndExcluding": "1.1.1zh",
              "versionStartIncluding": "1.1.1"
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDB88756-EDFE-4886-A267-3F19342A6042",
              "versionEndExcluding": "3.0.21",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF7E21E7-AEC0-4882-B1F1-2D056B506F22",
              "versionEndExcluding": "3.4.6",
              "versionStartIncluding": "3.4.0"
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B6B9930-C549-4D88-9784-AF32CCDDB87A",
              "versionEndExcluding": "3.5.7",
              "versionStartIncluding": "3.5.0"
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D41B3C45-EC73-4DC8-989D-B2E2792E102F",
              "versionEndExcluding": "3.6.3",
              "versionStartIncluding": "3.6.0"
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E881B9A-1A0A-4BC0-8160-20C00561167D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "openssl-security@openssl.org"
}