Crypt::OpenSSL::PKCS12 vulnerabilities

4 known vulnerabilities in Crypt::OpenSSL::PKCS12 from Jonasbn. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Crypt::OpenSSL::PKCS12: NULL Pointer Dereference

  CVE-2026-17510Aug 9, 2026Jonasbn

  Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute. print_attribute() sizes the destination buffer for a BMPSTRING attribute from its declared byte length with `Renew(*

• 9.1 Critical severity

  Crypt::OpenSSL::PKCS12: Out-of-bounds Read

  CVE-2026-9265Jun 20, 2026Jonasbn

  Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_attribute() copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length via strncpy, leaving no NUL ter

• 9.8 Critical severity

  Crypt::OpenSSL::PKCS12: Improper Null Termination

  CVE-2026-8721May 17, 2026Jonasbn

  Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded. The C code (or OpenSSL

• 9.8 Critical severity

  Crypt::OpenSSL::PKCS12: Out-of-bounds Write

  CVE-2026-8507May 17, 2026Jonasbn

  Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws. When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap out-of-bounds write would be trigg