Picotls
Monthly
Stack exhaustion in the Picotls minicrypto backend's custom ASN.1 validator allows an attacker who can supply crafted private-key material to crash any application that calls ptls_minicrypto_load_private_key() or the public ptls_asn1_validation() API on untrusted DER input. All Picotls versions prior to upstream commit c14231d80 are affected when the minicrypto backend is in use; applications using the libcrypto (OpenSSL) backend are immune because OpenSSL performs its own bounded DER parsing. No public exploit has been identified and no CISA KEV listing exists; CVSS 5.5 reflects a local, user-interaction-dependent denial-of-service with no code execution potential.
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Stack exhaustion in the Picotls minicrypto backend's custom ASN.1 validator allows an attacker who can supply crafted private-key material to crash any application that calls ptls_minicrypto_load_private_key() or the public ptls_asn1_validation() API on untrusted DER input. All Picotls versions prior to upstream commit c14231d80 are affected when the minicrypto backend is in use; applications using the libcrypto (OpenSSL) backend are immune because OpenSSL performs its own bounded DER parsing. No public exploit has been identified and no CISA KEV listing exists; CVSS 5.5 reflects a local, user-interaction-dependent denial-of-service with no code execution potential.
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.