Fluid Attacks Database

Description

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3_EXT_d2i(ext) returns NULL when an extension's DER value fails to parse. basicC, ia5string, and auth_att dereference its result without a NULL check. keyid_data also dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when the parse succeeds. A caller invoking an affected helper on an extension from an untrusted certificate triggers a SIGSEGV that crashes the Perl process.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	libcrypt-openssl-x509-perl	=1.9.02-1 \|\| =1.9.10-1 \|\| =1.9.12-1 \|\| =1.9.13-1 \|\| =1.9.14-1 \|\| =1.9.14-2 \|\| =1.9.15-1 \|\| =2.0.0+pristine-1 \|\| =2.0.1-1 \|\| =2.1.1-1 \|\| =2.1.2-1 \|\| =2.1.3-1	-
debian 12	libcrypt-openssl-x509-perl	=1.9.14-2 \|\| =1.9.15-1 \|\| =2.0.0+pristine-1 \|\| =2.0.1-1 \|\| =2.1.1-1 \|\| =2.1.2-1 \|\| =2.1.3-1	-
debian 14	libcrypt-openssl-x509-perl	=2.0.1-1 \|\| =2.1.1-1 \|\| =2.1.2-1 \|\| >=0 <2.1.3-1	2.1.3-1
debian 13	libcrypt-openssl-x509-perl	=2.0.1-1 \|\| =2.1.1-1 \|\| =2.1.2-1 \|\| =2.1.3-1	-

Aliases

1. CVE-2026-581012. NVD-2026-581013. OSV-DEBIAN-2026-581014. OSV-2026-581015. SECURITY-TRACKER-CVE-2026-58101

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.