VulnSocial

CVE-2026-58102Disclosure(jonasbn / crypt\)

LOWCVSS 9.1 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_exts. When building the extension hash (via extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_oid()), the code passes OBJ_obj2txt()'s return value as the hash-key length; because that value is the OID's full text length rather than the bytes written to the fixed-size buffer (129 bytes), an OID whose text is longer than the 129-byte buffer causes a read past the allocation, exposing adjacent heap memory as the returned hash key. extensions_by_name() uses the static shortname path and is not affected.

jonasbn CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Other references
Weakness type (CWE)
CWE-125

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • crypt\

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • 3 total mentions across 1 day

Affected systems

Vendors
jonasbn
Products
crypt\

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-07-14: 3Technical Details · 2026-07-14: 307-14
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets5 URLs
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    Perl CPAN CVE-2026-57433: Storable before 3.41 have a signed integer overflow when deserializing a crafted SX_HOOK record https://www.openwall.com/lists/oss-security/2026/07/13/7 2 CVEs Crypt::OpenSSL::X509 before 2.1.3 https://www.openwall.com/lists/oss-security/2026/07/13/8 CVE-2026-58101: DoS via NULL ptr deref CVE-2026-58102: Heap OOB read

    Post summary

    The snippet provides brief disclosure of several CVEs with technical details but no exploit code, PoC, active exploitation or patch information.

    10010165
    4.7K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-58102 Heap Out-of-Bounds Read in Crypt::OpenSSL::X509 via Long Certific... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-58102 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4

    Post summary

    The tweet references CVE‑2026‑58102, describing it as a heap out‑of‑bounds read in Crypt::OpenSSL::X509 triggered by long certificates, and links to Vulmon for details, but provides no PoC, exploit code, patch info, or evidence of active exploitation.

    01010110
    4.1K followersView on X
  • Israel@f1tym1
    Disclosure

    Crypt::OpenSSL::X509 before 2․1․3 allows heap out-of-bounds read via long OID in hv_exts, exposing adjacent heap memory. CVE-2026-58102. https://ift.tt/LmP2epa

    Post summary

    The post announces a heap OOB read flaw in Crypt::OpenSSL::X509 (CVE‑2026‑58102) with technical details but no PoC, exploit code, active exploitation report, or patch information.

    0000061
    1.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appjonasbncrypt\\--

Explore more

Back to dashboardjonasbn CVEscrypt\ vulnerabilities