When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap-OOB-WRITE would be triggered which could have Remote Code Execution (RCE) potential.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| JONASBN | Crypt::OpenSSL::PKCS12 | unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Upgrade to 1.95 or later.
Workaround
Do not parse untrusted PKCS12 files via info or info_as_hash.
Sun, 17 May 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out of bound (OOB) write flaws. When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap-OOB-WRITE would be triggered which could have Remote Code Execution (RCE) potential. | |
| Title | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out of bound (OOB) write flaws | |
| Weaknesses | CWE-787 | |
| References |
|
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-05-17T18:43:05.863Z
Reserved: 2026-05-13T22:45:07.737Z
Link: CVE-2026-8507
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-17T19:16:24.590
Modified: 2026-05-17T19:16:24.590
Link: CVE-2026-8507
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-05-17T20:30:09Z