CVE-2026-58101

Name of the Vulnerable Software and Affected Versions Crypt::OpenSSL::X509 versions prior to 2.1.3

Description A denial of service can occur due to a NULL pointer dereference. The function X509V3 EXT d2i(ext) returns NULL when a DER (Distinguished Encoding Rules) value of an extension fails to parse. The functions basicC(), ia5string(), and auth att() dereference this result without performing a NULL check. Additionally, keyid data() dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE even if the parse succeeds. An attacker can trigger a SIGSEGV, causing the Perl process to crash, by providing an untrusted certificate to an affected helper.

Recommendations Update to version 2.1.3 or later.