Bug 2499853 (CVE-2026-58102)

Summary: CVE-2026-58102 perl-Crypt-OpenSSL-X509: Crypt::OpenSSL::X509: Information disclosure due to heap out-of-bounds read.
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Crypt::OpenSSL::X509. A remote attacker could exploit this vulnerability by providing a specially crafted certificate that includes an overly long Object Identifier (OID) in its extensions. During the processing of this certificate, the software incorrectly handles the OID length, leading to a read beyond the intended memory boundary. This heap out-of-bounds read can expose sensitive information from adjacent memory.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2512101, 2512102    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-13 23:02:01 UTC 
Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_exts.

When building the extension hash (via extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_oid()), the code passes OBJ_obj2txt()'s return value as the hash-key length; because that value is the OID's full text length rather than the bytes written to the fixed-size buffer (129 bytes), an OID whose text is longer than the 129-byte buffer causes a read past the allocation, exposing adjacent heap memory as the returned hash key. extensions_by_name() uses the static shortname path and is not affected.