{"id":"CVE-2026-34180","summary":"Heap Buffer Over-read in ASN.1 Content Parsing","details":"Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer.  More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL's ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\nworst case the truncated length is treated as a request to scan the binary\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\nless than or beyond the end of the allocated buffer.\n\nApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\nany other d2i_* decoding function are affected. OpenSSL's own command-line\ntools are not vulnerable, as data read through the BIO layer is checked before\nit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\nplatforms; 32-bit platforms and 64-bit Windows are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.","modified":"2026-07-15T17:36:06.935939Z","published":"2026-06-09T16:03:17.082Z","related":["ALSA-2026:25237","ALSA-2026:25239","CGA-4x9c-9p39-m4x3","SUSE-SU-2026:22100-1","SUSE-SU-2026:22132-1","SUSE-SU-2026:22251-1","SUSE-SU-2026:22315-1","SUSE-SU-2026:2392-1","SUSE-SU-2026:2393-1","SUSE-SU-2026:2396-1","SUSE-SU-2026:2397-1","SUSE-SU-2026:2399-1","SUSE-SU-2026:2403-1","SUSE-SU-2026:2404-1","SUSE-SU-2026:2405-1","SUSE-SU-2026:2598-1","SUSE-SU-2026:2614-1","SUSE-SU-2026:2648-1","openSUSE-SU-2026:11023-1","openSUSE-SU-2026:21005-1"],"database_specific":{"cna_assigner":"openssl","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34180.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34180.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34180"},{"type":"ADVISORY","url":"https://openssl-library.org/news/secadv/20260609.txt"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openssl/openssl","events":[{"introduced":"e818b74be2170fbe957a07b0da4401c2b694b3b8"},{"fixed":"e818b74be2170fbe957a07b0da4401c2b694b3b8"},{"introduced":"e04bd3433fd84e1861bf258ea37928d9845e6a86"},{"fixed":"e04bd3433fd84e1861bf258ea37928d9845e6a86"},{"introduced":"89cd17a031e022211684eb7eb41190cf1910f9fa"},{"fixed":"51ea949dc1436e865935b47874b21a3bb31a102e"},{"introduced":"98acb6b02839c609ef5b837794e08d906d965335"},{"fixed":"c5ea1cc227fd60afae8ac4b9438690bbe4888f79"},{"introduced":"636dfadc70ce26f2473870570bfd9ec352806b1d"},{"fixed":"8cf17aaeb4599f8af87fefd810b5b5fee90fe69e"},{"introduced":"7b371d80d959ec9ab4139d09d78e83c090de9779"},{"fixed":"aae016bfd52fcad2bc9657c2c782cfdf73b1ed5f"},{"introduced":"11b7b6ea3b65a584e1d31408ed1bdb139465cffd"},{"fixed":"1c6908e4fa5fa568752221d8eaf561a809751e5d"},{"fixed":"cbe418ae978539cf14a398a207dba834c0e93e83"},{"fixed":"d93853c42110d6319e3df07842b488cb9f7ac5ff"},{"fixed":"da5d62af75f69d6fbf7803743d7c56ac75461e43"},{"fixed":"f696c73c3e61b8c502d040af62e690c060908a16"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.0.2"},{"fixed":"1.0.2zq"},{"introduced":"1.1.1"},{"fixed":"1.1.1zh"},{"introduced":"3.0.0"},{"fixed":"3.0.21"},{"introduced":"3.4.0"},{"fixed":"3.4.6"},{"introduced":"3.5.0"},{"fixed":"3.5.7"},{"introduced":"3.6.0"},{"fixed":"3.6.3"},{"introduced":"4.0.0-NA"},{"last_affected":"4.0.0-NA"}]}}],"versions":["4.0.0-NA","openssl-4.0.0","openssl-3.0.20","openssl-3.4.5","openssl-3.5.6","openssl-3.6.2","openssl-3.0.19","openssl-3.4.4","openssl-3.5.5","openssl-3.6.1","3.4-POST-CLANG-FORMAT-WEBKIT","3.0-POST-CLANG-FORMAT-WEBKIT","3.4-PRE-CLANG-FORMAT-WEBKIT","3.5-POST-CLANG-FORMAT-WEBKIT","3.0-PRE-CLANG-FORMAT-WEBKIT","3.5-PRE-CLANG-FORMAT-WEBKIT","3.6-POST-CLANG-FORMAT-WEBKIT","3.6-PRE-CLANG-FORMAT-WEBKIT","openssl-3.6.0","openssl-3.0.18","openssl-3.4.3","openssl-3.5.4","openssl-3.5.3","openssl-3.5.2","openssl-3.0.17","openssl-3.4.2","openssl-3.5.1","openssl-3.5.0","openssl-3.0.16","openssl-3.4.1","openssl-3.4.0","openssl-3.0.15","openssl-3.0.14","openssl-3.0.13","openssl-3.0.12","openssl-3.0.11","openssl-3.0.10","openssl-3.0.9","openssl-3.0.8","openssl-3.0.7","openssl-3.0.6","openssl-3.0.5","openssl-3.0.4","openssl-3.0.3","openssl-3.0.2","openssl-3.0.1","openssl-3.0.0"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43","target":{"file":"crypto/asn1/tasn_dec.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["126341431044776940549287222658722596257","130570927788432269899785168744788951172","194169660864360803525450492876473860091","53214108288776647741275233147654436526","263946134258438649256241779625323641089","232531144570205203842568959033909256821","50105547378036962616739399907795763233","35026789599821935911816818772042439275","114710208109255960726965919362105298762","125554540231637930487019176647117002503","332182547294553747961268671162250805775","276033856309860817184326883455361222142","318268129131630080093563577138856184340","128526451235089518533697095563624199685","75522999902161732913968142567093758009","233242365504435285051066046524808432015","197089990496411212407345093272572794903","320267436817932155653906178307380969200","30115894267600804239536856163586595677","23558578592795469757909103851850343171","17799849957227699774711002123141587857","42341873062082005998984807998045276374","261393998870568144932847193933630306924","90961471150301180096894104068604511683","128676851434441285018275177161089865561","100194122663462334847528959275194658724","130566677364000324829985761619485595933","139450354736387718719450085420863140797","58621743932426957895629831490869659400","117543249045315008245940431878629833089","16026874736481656198404158159631764460","330524745316556226745010539469934831546","327748363202757222487231988002875540466","308414666606692371225601335823336131302"]},"id":"CVE-2026-34180-0ae5bbd2","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"73859934412863856772425858944783637993","length":3029},"id":"CVE-2026-34180-1692fb8c","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16","target":{"file":"crypto/asn1/tasn_dec.c","function":"asn1_ex_c2i"},"deprecated":false},{"digest":{"function_hash":"73859934412863856772425858944783637993","length":3029},"id":"CVE-2026-34180-3938e24c","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43","target":{"file":"crypto/asn1/tasn_dec.c","function":"asn1_ex_c2i"},"deprecated":false},{"id":"CVE-2026-34180-5268d8ae","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83","target":{"file":"crypto/asn1/tasn_dec.c"},"deprecated":false,"digest":{"line_hashes":["126341431044776940549287222658722596257","130570927788432269899785168744788951172","194169660864360803525450492876473860091","53214108288776647741275233147654436526","263946134258438649256241779625323641089","232531144570205203842568959033909256821","50105547378036962616739399907795763233","35026789599821935911816818772042439275","114710208109255960726965919362105298762","125554540231637930487019176647117002503","332182547294553747961268671162250805775","276033856309860817184326883455361222142","318268129131630080093563577138856184340","128526451235089518533697095563624199685","75522999902161732913968142567093758009","233242365504435285051066046524808432015","197089990496411212407345093272572794903","320267436817932155653906178307380969200","30115894267600804239536856163586595677","23558578592795469757909103851850343171","17799849957227699774711002123141587857","42341873062082005998984807998045276374","261393998870568144932847193933630306924","90961471150301180096894104068604511683","128676851434441285018275177161089865561","100194122663462334847528959275194658724","130566677364000324829985761619485595933","90371650052899301631217696225591147992","246784737627998664119002956221509877842","315371643750711437594895449353374659288","286011929765548229255520019142347591441","123472680076330230192277232253048086730","13780735696208980306919453088952308039","25913059314610070854202480799497690613"],"threshold":0.9}},{"target":{"file":"crypto/asn1/tasn_dec.c"},"deprecated":false,"digest":{"line_hashes":["126341431044776940549287222658722596257","130570927788432269899785168744788951172","194169660864360803525450492876473860091","53214108288776647741275233147654436526","263946134258438649256241779625323641089","232531144570205203842568959033909256821","50105547378036962616739399907795763233","35026789599821935911816818772042439275","114710208109255960726965919362105298762","125554540231637930487019176647117002503","332182547294553747961268671162250805775","276033856309860817184326883455361222142","318268129131630080093563577138856184340","128526451235089518533697095563624199685","75522999902161732913968142567093758009","233242365504435285051066046524808432015","197089990496411212407345093272572794903","320267436817932155653906178307380969200","30115894267600804239536856163586595677","23558578592795469757909103851850343171","17799849957227699774711002123141587857","42341873062082005998984807998045276374","261393998870568144932847193933630306924","90961471150301180096894104068604511683","128676851434441285018275177161089865561","100194122663462334847528959275194658724","130566677364000324829985761619485595933","139450354736387718719450085420863140797","58621743932426957895629831490869659400","117543249045315008245940431878629833089","16026874736481656198404158159631764460","330524745316556226745010539469934831546","327748363202757222487231988002875540466","308414666606692371225601335823336131302"],"threshold":0.9},"id":"CVE-2026-34180-7ebd8535","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83","target":{"file":"crypto/asn1/tasn_dec.c","function":"asn1_ex_c2i"},"deprecated":false,"digest":{"function_hash":"51740365743783670239691639319351368665","length":2819},"id":"CVE-2026-34180-8b17af82","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["126341431044776940549287222658722596257","130570927788432269899785168744788951172","194169660864360803525450492876473860091","53214108288776647741275233147654436526","263946134258438649256241779625323641089","232531144570205203842568959033909256821","50105547378036962616739399907795763233","35026789599821935911816818772042439275","114710208109255960726965919362105298762","125554540231637930487019176647117002503","332182547294553747961268671162250805775","276033856309860817184326883455361222142","318268129131630080093563577138856184340","128526451235089518533697095563624199685","75522999902161732913968142567093758009","233242365504435285051066046524808432015","197089990496411212407345093272572794903","320267436817932155653906178307380969200","30115894267600804239536856163586595677","23558578592795469757909103851850343171","17799849957227699774711002123141587857","42341873062082005998984807998045276374","261393998870568144932847193933630306924","90961471150301180096894104068604511683","128676851434441285018275177161089865561","100194122663462334847528959275194658724","130566677364000324829985761619485595933","139450354736387718719450085420863140797","58621743932426957895629831490869659400","117543249045315008245940431878629833089","16026874736481656198404158159631764460","330524745316556226745010539469934831546","327748363202757222487231988002875540466","308414666606692371225601335823336131302"],"threshold":0.9},"id":"CVE-2026-34180-9aeaec3a","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff","target":{"file":"crypto/asn1/tasn_dec.c"}},{"source":"https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d","target":{"file":"crypto/asn1/tasn_dec.c","function":"asn1_ex_c2i"},"deprecated":false,"digest":{"function_hash":"73859934412863856772425858944783637993","length":3029},"id":"CVE-2026-34180-a3d8c13c","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff","target":{"file":"crypto/asn1/tasn_dec.c","function":"asn1_ex_c2i"},"deprecated":false,"digest":{"function_hash":"73859934412863856772425858944783637993","length":3029},"id":"CVE-2026-34180-c02f3ec9","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["28170854778703993674264004058177114599","73132526844288570625317440636111911761","177405411499435185068645597737938634778","224809958623850711330610094965797758930","295554444428855106393106961197201359586"],"threshold":0.9},"id":"CVE-2026-34180-c377fa22","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/e04bd3433fd84e1861bf258ea37928d9845e6a86","target":{"file":"include/openssl/opensslv.h"}},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/e818b74be2170fbe957a07b0da4401c2b694b3b8","target":{"file":"crypto/opensslv.h"},"deprecated":false,"digest":{"line_hashes":["251633914150035957322733061977107206211","338514574181828579838011565939158652696","76638288692106140328510055542557597351","142922657400765574308962710386922248045","71649992455794854055653842592139575350","65527166711110472566013424527579064967","253196866009476977787139000804413898733","172177136897997206866313011107384691461"],"threshold":0.9},"id":"CVE-2026-34180-e051451f","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16","target":{"file":"crypto/asn1/tasn_dec.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["126341431044776940549287222658722596257","130570927788432269899785168744788951172","194169660864360803525450492876473860091","53214108288776647741275233147654436526","263946134258438649256241779625323641089","232531144570205203842568959033909256821","50105547378036962616739399907795763233","35026789599821935911816818772042439275","114710208109255960726965919362105298762","125554540231637930487019176647117002503","332182547294553747961268671162250805775","276033856309860817184326883455361222142","318268129131630080093563577138856184340","128526451235089518533697095563624199685","75522999902161732913968142567093758009","233242365504435285051066046524808432015","197089990496411212407345093272572794903","320267436817932155653906178307380969200","30115894267600804239536856163586595677","23558578592795469757909103851850343171","17799849957227699774711002123141587857","42341873062082005998984807998045276374","261393998870568144932847193933630306924","90961471150301180096894104068604511683","128676851434441285018275177161089865561","100194122663462334847528959275194658724","130566677364000324829985761619485595933","139450354736387718719450085420863140797","58621743932426957895629831490869659400","117543249045315008245940431878629833089","16026874736481656198404158159631764460","330524745316556226745010539469934831546","327748363202757222487231988002875540466","308414666606692371225601335823336131302"]},"id":"CVE-2026-34180-e0e0a062"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34180.json","vanir_signatures_modified":"2026-07-15T17:36:06Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}