Missing ASN1_TYPE validation in PKCS#12 parsing

🗓️ 27 Jan 2026 00:00:00Reported by OpenSSLType

ASN1_TYPE type confusion in OpenSSL PKCS#12 parsing causes NULL pointer dereference and DoS.

Reporter	Title	Published	Views	Family All 240
IBM Security Bulletins	Security Bulletin: IBM i is affected by multiple vulnerabilities in OpenSSL	17 Mar 202621:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in openssl affects IBM Netezza Appliance	12 May 202606:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ is affected by multiple CVEs (CVE-2025-11187, CVE-2025-15467, CVE-2025-15468, CVE-2025-15469, CVE-2025-66199, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796)	2 Mar 202611:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities impact AIX/VIOS due to OpenSSL	9 Mar 202621:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in OpenSSL	20 Jul 202614:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway vulnerable to Denial of Service	27 Mar 202617:55	–	ibm
FreeBSD	OpenSSL -- Multiple vulnerabilities	27 Jan 202600:00	–	freebsd
ATTACKERKB	CVE-2026-22795	27 Jan 202616:01	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : openssl, openssl-devel, openssl-fips-provider-latest (ALAS2023-2026-1434)	19 Feb 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : edk2, --advisory ALAS2-2026-3150 (ALAS-2026-3150)	19 Feb 202600:00	–	nessus

Vulners

Node

openssl opensslRange3.6.0–3.6.1

openssl opensslRange3.5.0–3.5.5

openssl opensslRange3.4.0–3.4.4

openssl opensslRange3.3.0–3.3.6

openssl opensslRange3.0.0–3.0.19

openssl opensslRange1.1.1–1.1.1ze

27 Jan 2026 00:00Current

CVSS 3.15.5

EPSS0.00146

SSVC