EUVD-2026-64165Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted deeply-nested DER file
-
DeliveryApplication or operator loads file via ptls_minicrypto_load_private_key()
-
ExploitASN.1 validator recurses without depth limit
-
ExecutionProcess stack exhausted
-
ImpactApplication crash (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires all three of the following: (1) the target application uses Picotls compiled with the minicrypto backend, not libcrypto/OpenSSL - applications using the OpenSSL backend are categorically immune; (2) the application calls ptls_minicrypto_load_private_key() or the public ptls_asn1_validation() API on attacker-controlled DER data, meaning the attacker must have a channel to supply a raw private-key file or equivalent byte input; and (3) a local user or automated process must trigger the key-loading operation (CVSS UI:R), so there is no direct network-reachable code path into the vulnerable parser. Exploitation is strictly limited to denial of service (process crash); there is no stack control, no heap interaction, and no code execution possibility. Production TLS servers that load private keys exclusively from operator-controlled filesystem paths are not at realistic risk regardless of backend. |
| Impact | The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) appropriately reflects a local, user-interaction-dependent denial of service with no confidentiality or integrity impact. EPSS data was not provided in the input, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no standalone public exploit code has been identified - only the regression test added in the fix commit. Real-world risk is further constrained by two structural factors: the attack path requires the application to load attacker-supplied private-key material (not a typical production path where keys are loaded from trusted operator-controlled storage), and only the minicrypto backend is affected (deployments backed by OpenSSL are categorically immune). The primary at-risk scenarios are multi-tenant key management services, automated certificate-provisioning pipelines, developer tooling, or any system where users can submit raw private-key files for processing. A high-CVSS-but-narrower-real-risk framing does not apply here because the CVSS score itself is moderate; this is correctly characterized as a limited-scope DoS requiring a specific deployment pattern. |
| Exploit ScenarioDerived | An attacker with the ability to supply a crafted file through any mechanism that reaches ptls_minicrypto_load_private_key() - such as a multi-tenant certificate management API, an automated key-import pipeline, or a developer CLI tool that accepts user-specified key paths - submits a DER-encoded PKCS#8 file containing deeply nested SEQUENCE elements (e.g., 40+ levels). When the application parses the file, the recursive ASN.1 validator overflows the process stack and crashes the application. The regression test added in the fix commit provides a working construction algorithm, reducing the effort required to reproduce the crash. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 21, 2026
Stack exhaustion in the Picotls minicrypto backend's custom ASN.1 validator allows an attacker who can supply crafted private-key material to crash any application that calls ptls_minicrypto_load_private_key() or the public ptls_asn1_validation() API on untrusted DER input. All Picotls versions prior to upstream commit c14231d80 are affected when the minicrypto backend is in use; applications using the libcrypto (OpenSSL) backend are immune because OpenSSL performs its own bounded DER parsing. No public exploit has been identified and no CISA KEV listing exists; CVSS 5.5 reflects a local, user-interaction-dependent denial-of-service with no code execution potential.
RemediationAI
The upstream fix is available as commit c14231d801407640bc42c2dcf92783409ea6a7c7 (https://github.com/h2o/picotls/commit/c14231d801407640bc42c2dcf92783409ea6a7c7); consumers should update to a build that incorporates this commit. No tagged release version has been independently confirmed as containing the patch at time of analysis - verify with the downstream package maintainer or build directly from the fixed commit. The most effective immediate workaround for applications not yet patched is to switch from the minicrypto backend to the libcrypto (OpenSSL) backend, which is entirely immune to this vulnerability; the trade-off is an added dependency on OpenSSL and a larger binary footprint. If switching backends is not feasible, restrict the private-key loading path so that only operator-controlled, pre-validated key material is ever passed to ptls_minicrypto_load_private_key() - specifically, do not expose this function to externally supplied files or API inputs without prior sanitization. Blocking untrusted DER input at the application boundary eliminates the attack surface without requiring a code change.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Picotls (CPE: cpe:2.3:a:h2o:picotls:*:*:*:*:*:*:*:*) is a C TLS library developed under the h2o project that supports pluggable crypto backends. Its built-in minicrypto backend includes a hand-written ASN.1 DER parser/validator (lib/asn1.c) used when reading PKCS#8-encoded private keys. The root cause - assigned CWE-835 (Loop with Unreachable Exit Condition, though CWE-674 Uncontrolled Recursion is the more precise classification) - is that the recursive descent function ptls_asn1_validation() enters constructed elements (e.g., SEQUENCE, tag 0x30) without tracking or bounding nesting depth. A DER payload can encode arbitrarily many nested SEQUENCE wrappers; each level consumes a stack frame until the OS-enforced stack limit is exceeded, causing a segfault or similar crash. The fix introduced the compile-time constant PTLS_ASN1_MAX_RECURSION = 32 and returns PTLS_ERROR_INCORRECT_ASN1_SYNTAX when that depth is breached. A regression test was also added (t/minicrypto.c) that verifies depth-32 input is accepted and depth-40 input is rejected, providing a working blueprint of the triggering payload structure. The libcrypto (OpenSSL) backend delegates all DER parsing to OpenSSL, which enforces its own recursion limits and is therefore unaffected.
Know when Picotls gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
AV:L and UI:R because a user must load an attacker-supplied file; PR:N since the attacker needs no system privileges to craft the payload; availability-only impact with no C or I.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS#8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c7, the validator recursively descends into constructed ASN.1 elements without enforcing a maximum nesting depth. If an application loads an attacker-supplied private-key file through ptls_minicrypto_load_private_key(), or otherwise calls the public ASN.1 validation API on untrusted DER, a crafted deeply nested ASN.1 structure can exhaust the process stack and crash the application. Note that the libcrypto (OpenSSL) backend does not use the ASN.1 validation helper of picotls, and therefore is immune to this vulnerability. The vulnerability has been addressed in commit c14231d801407640bc42c2dcf92783409ea6a7c7.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Rated crit
A NULL-pointer dereference in the picotls TLS 1.3 library crashes any process that uses picotls as its client-side TLS s
Exploit-DB