EUVD-2026-64165Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
AV:L and UI:R because a user must load an attacker-supplied file; PR:N since the attacker needs no system privileges to craft the payload; availability-only impact with no C or I.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS#8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c7, the validator recursively descends into constructed ASN.1 elements without enforcing a maximum nesting depth. If an application loads an attacker-supplied private-key file through ptls_minicrypto_load_private_key(), or otherwise calls the public ASN.1 validation API on untrusted DER, a crafted deeply nested ASN.1 structure can exhaust the process stack and crash the application. Note that the libcrypto (OpenSSL) backend does not use the ASN.1 validation helper of picotls, and therefore is immune to this vulnerability. The vulnerability has been addressed in commit c14231d801407640bc42c2dcf92783409ea6a7c7.
AnalysisAI
Stack exhaustion in the Picotls minicrypto backend's custom ASN.1 validator allows an attacker who can supply crafted private-key material to crash any application that calls ptls_minicrypto_load_private_key() or the public ptls_asn1_validation() API on untrusted DER input. All Picotls versions prior to upstream commit c14231d80 are affected when the minicrypto backend is in use; applications using the libcrypto (OpenSSL) backend are immune because OpenSSL performs its own bounded DER parsing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following: (1) the target application uses Picotls compiled with the minicrypto backend, not libcrypto/OpenSSL - applications using the OpenSSL backend are categorically immune; (2) the application calls ptls_minicrypto_load_private_key() or the public ptls_asn1_validation() API on attacker-controlled DER data, meaning the attacker must have a channel to supply a raw private-key file or equivalent byte input; and (3) a local user or automated process must trigger the key-loading operation (CVSS UI:R), so there is no direct network-reachable code path into the vulnerable parser. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) appropriately reflects a local, user-interaction-dependent denial of service with no confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The upstream fix is available as commit c14231d801407640bc42c2dcf92783409ea6a7c7 (https://github.com/h2o/picotls/commit/c14231d801407640bc42c2dcf92783409ea6a7c7); consumers should update to a build that incorporates this commit. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today