{"id":"JLSEC-2026-233","summary":"openssl-src vulnerable to Use-after-free following `BIO_new_NDEF`","details":"The public API function `BIO_new_NDEF` is a helper function used for streaming\nASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the\nSMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by\nend user applications.\n\nThe function receives a BIO from the caller, prepends a new `BIO_f_asn1` filter\nBIO onto the front of it to form a BIO chain, and then returns the new head of\nthe BIO chain to the caller. Under certain conditions, for example if a CMS\nrecipient public key is invalid, the new filter BIO is freed and the function\nreturns a NULL result indicating a failure. However, in this case, the BIO chain\nis not properly cleaned up and the BIO passed by the caller still retains\ninternal pointers to the previously freed filter BIO. If the caller then goes on\nto call `BIO_pop()` on the BIO then a use-after-free will occur. This will most\nlikely result in a crash.\n\nThis scenario occurs directly in the internal function `B64_write_ASN1()` which\nmay cause `BIO_new_NDEF()` to be called and will subsequently call `BIO_pop()` on\nthe BIO. This internal function is in turn called by the public API functions\n`PEM_write_bio_ASN1_stream`, `PEM_write_bio_CMS_stream`, `PEM_write_bio_PKCS7_stream`,\n`SMIME_write_ASN1`, `SMIME_write_CMS` and `SMIME_write_PKCS7`.\n\nOther public API functions that may be impacted by this include\n`i2d_ASN1_bio_stream`, `BIO_new_CMS`, `BIO_new_PKCS7`, `i2d_CMS_bio_stream` and\n`i2d_PKCS7_bio_stream`.\n\nThe OpenSSL cms and smime command line applications are similarly affected.","modified":"2026-07-25T18:24:07.321115348Z","published":"2026-04-27T18:33:55.942Z","upstream":["CVE-2023-0215","GHSA-r7jw-wp68-3xch","EUVD-2023-0789"],"database_specific":{"license":"CC-BY-4.0","sources":[{"id":"CVE-2023-0215","imported":"2026-07-17T21:25:38.419Z","modified":"2026-06-17T05:25:02.560Z","published":"2023-02-08T20:15:24.107Z","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-0215","html_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0215","database_specific":{"status":"Modified"}},{"url":"https://api.github.com/advisories/GHSA-r7jw-wp68-3xch","html_url":"https://github.com/advisories/GHSA-r7jw-wp68-3xch","id":"GHSA-r7jw-wp68-3xch","imported":"2026-07-17T21:25:38.591Z","modified":"2025-11-04T22:09:25Z","published":"2023-02-08T22:28:34Z"},{"modified":"2025-11-04T19:14:32Z","published":"2023-02-08T19:03:28Z","url":"https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2023-0789","html_url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-0789","id":"EUVD-2023-0789","imported":"2026-07-17T21:25:49.060Z"}]},"references":[{"type":"WEB","url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8818064ce3c3c0f1b740a5aaba2a987e75bfbafd"},{"type":"WEB","url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9816136fe31d92ace4037d5da5257f763aeeb4eb"},{"type":"WEB","url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c3829dd8825c654652201e16f8a0a0c46ee3f344"},{"type":"WEB","url":"https://github.com/advisories/GHSA-r7jw-wp68-3xch"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0215"},{"type":"WEB","url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2023-0009.html"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202402-08"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20230427-0007"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20230427-0007/"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20230427-0009"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20230427-0009/"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240621-0006"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240621-0006/"},{"type":"WEB","url":"https://www.openssl.org/news/secadv/20230207.txt"}],"affected":[{"package":{"name":"OpenSSL_jll","ecosystem":"Julia","purl":"pkg:julia/OpenSSL_jll?uuid=458c3c95-2e84-50aa-8efc-19380b2a3a95"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.20+0"}]}],"database_specific":{"source":"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-233.json"}},{"package":{"name":"Openresty_jll","ecosystem":"Julia","purl":"pkg:julia/Openresty_jll?uuid=87da34d4-7b1b-5a94-8376-8cb65bf3132c"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.1+0"}]}],"database_specific":{"source":"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-233.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"credits":[{"name":"another-rex","contact":["https://github.com/another-rex"],"type":"ANALYST"}]}