CVE-2026-45271

Name of the Vulnerable Software and Affected Versions Picotls versions prior to commit c14231d801407640bc42c2dcf92783409ea6a7c7

Description The ASN.1 validation helper used by the minicrypto backend for parsing local PKCS#8 private keys recursively descends into constructed ASN.1 elements without enforcing a maximum nesting depth. When an application processes untrusted DER data or loads an attacker-supplied private-key file via the ptls minicrypto load private key() function, a crafted deeply nested ASN.1 structure can cause process stack exhaustion, leading to an application crash. The libcrypto (OpenSSL) backend is not affected as it does not utilize this specific validation helper.

Recommendations Update to the version containing commit c14231d801407640bc42c2dcf92783409ea6a7c7. As a temporary mitigation, avoid using the ptls minicrypto load private key() function with untrusted private-key files.