CVE-2026-58102

Name of the Vulnerable Software and Affected Versions Crypt::OpenSSL::X509 versions prior to 2.1.3

Description A heap out-of-bounds read exists in hv exts when processing a long certificate extension OID (Object Identifier). When building the extension hash through the functions extensions(), extensions by long name(), extensions by oid(), or has extension oid(), the code uses the return value of OBJ obj2txt() as the hash-key length. Since this value represents the full text length of the OID rather than the actual bytes written to the 129-byte fixed-size buffer, any OID exceeding 129 bytes causes a read past the allocation, which exposes adjacent heap memory as the returned hash key.

Recommendations Update to version 2.1.3 or later.