https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 07:56:19 +0000 https://vulnerability.circl.lu/vuln/cve-2026-42766 <p><strong>Affected:</strong> OpenSSL</p> <p>Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption.</p> <p>Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service.</p> <p>The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present.</p> <p>An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service.</p> <p>Applications that process password-encrypted CMS messages may be affected.</p> <p>The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.</p> <p><strong>Affected:</strong> OpenSSL</p> <p>Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption.</p> <p>Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service.</p> <p>The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present.</p> <p>An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service.</p> <p>Applications that process password-encrypted CMS messages may be affected.</p> <p>The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.</p> https://vulnerability.circl.lu/vuln/cve-2026-42766