PKI Weekly Watch: OpenSSL Security Fixes to Review

Opening summary

This PKI Weekly Watch reviews still-relevant OpenSSL security fixes from June 2026 the release of OpenSSL 4.0.1, which patches seven security vulnerabilities discovered in recent months. These issues range from heap buffer over-reads to memory corruption and affect multiple OpenSSL components including ASN.1 parsing, PKCS#12 processing, CMS messaging, and the QUIC implementation.

This week’s PKI highlights

• Heap Buffer Over-read in ASN.1 Content Parsing (CVE-2026-34180): Parsing crafted DER-encoded ASN.1 structures with large content lengths may cause heap buffer over-reads on 64-bit Unix platforms, potentially leading to denial of service.
• PKCS#12 Files with PBMAC1 Accepted with Short HMAC Keys (CVE-2026-34181): Insufficient validation of PKCS#12 files using the PBMAC1 integrity mechanism could allow forgery of certificates and private keys with a 1 in 256 probability.
• CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182): Flaws in CMS AuthEnvelopedData processing could allow attackers to bypass integrity validation or achieve key-equivalent functionality for CMS recipients.
• Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183): Flooding a QUIC server/client with PATH_CHALLENGE frames may exhaust heap memory, causing denial of service.
• Double-free When Checking OCSP Stapled Response (CVE-2026-35188): Malicious servers could trigger a double-free in TLS clients when delivering crafted OCSP stapled responses, potentially leading to denial of service or code execution.
• NULL Pointer Dereference in QUIC Server Initial Packet Handling (CVE-2026-42764): Sending QUIC initial packets with invalid tokens to servers with address validation disabled may cause crashes via NULL pointer dereference.
• NULL Dereference in Certificate Verification with OCSP Checking (CVE-2026-42765): Enabling both partial-chain and OCSP verification could lead to NULL pointer dereference and process crashes under specific conditions.

Why it matters

These vulnerabilities affect a wide range of applications and services that rely on OpenSSL for cryptographic operations, certificate handling, and secure communications. The heap over-read and double-free issues could lead to denial of service, while the PKCS#12 and CMS flaws could enable certificate and key forgery. The QUIC vulnerabilities impact QUIC protocol implementations, which are increasingly used for performance-optimized secure communications.

What admins should check

Administrators should:

1. Upgrade to OpenSSL 4.0.1 or later as soon as possible.
2. Verify that any services using OpenSSL have been updated and restarted.
3. Check for any applications or scripts that process PKCS#12 files or CMS messages and ensure they are not vulnerable to the described forgery scenarios.
4. Review QUIC server configurations to ensure address validation is enabled where appropriate to mitigate the NULL pointer dereference risk.
5. Monitor for any unusual crashes or memory exhaustion in applications using OpenSSL, especially those handling large ASN.1 structures or QUIC traffic.

Practical takeaway

The release of OpenSSL 4.0.1 is an important update for any environment using OpenSSL. The vulnerabilities addressed in this release could be exploited by attackers to disrupt services, forge credentials, or potentially execute arbitrary code. Prompt upgrading and validation of dependent services are essential steps to maintain a secure PKI and secure communications infrastructure.

Sources

• OpenSSL Vulnerabilities Page – Official list of vulnerabilities and affected versions.
• CVE-2026-34180 Details – Heap Buffer Over-read in ASN.1 Content Parsing.
• CVE-2026-34181 Details – PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys.
• CVE-2026-34182 Details – CMS AuthEnvelopedData Processing May Accept Forged Messages.
• CVE-2026-34183 Details – Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler.
• CVE-2026-35188 Details – Double-free When Checking OCSP Stapled Response.
• CVE-2026-42764 Details – NULL Pointer Dereference in QUIC Server Initial Packet Handling.
• CVE-2026-42765 Details – NULL Dereference in Certificate Verification with OCSP Checking.