CVE-2026-22796 ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function

Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS7 data where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS7 data. Impact summary: An application...

EUVD-2026-4813

Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS7 data where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS7 data. Impact summary: An application...

CVE-2026-22796 ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function

Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS7 data where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS7 data. Impact summary: An application...

CVE-2026-22796

OpenSSL vulnerability CVE-2026-22796 is a type confusion in PKCS#7 signature verification (PKCS7_digest_from_attributes). The issue arises when an ASN1_TYPE union member is read without validating its type, leading to invalid/NULL pointer dereference and a Denial of Service during processing malf...

CVE-2026-22795 Missing ASN1_TYPE validation in PKCS#12 parsing

Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS12 file. Impact summary: An application processing a malformed PKCS12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service. A type...

CVE-2026-22795

CVE-2026-22795 affects OpenSSL PKCS#12 parsing: a type confusion in the PKCS#12 processor and an ASN1_TYPE validation gap can allow a crafted PKCS#12 file to trigger an invalid/NULL pointer dereference, causing Denial of Service. Affected releases include OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, and 1.1....

CVE-2025-69420

CVE-2025-69420 is an OpenSSL vulnerability: a type confusion in the TimeStamp Response verification path (TS_RESP_verify_response) where an ASN1_TYPE union member is used without type validation, enabling a NULL dereference and Denial of Service. OpenSSL 3.0, 3.3, 3.4, 3.5, 3.6 and 1.1.1 are list...

CVE-2025-69420

Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An...

CVE-2025-69420 Missing ASN1_TYPE validation in TS_RESP_verify_response() function

Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An...

CVE-2025-69420 Missing ASN1_TYPE validation in TS_RESP_verify_response() function

Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An...

UBUNTU-CVE-2026-22796

Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS7 data where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS7 data. Impact summary: An application...

CVE-2026-22796

Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS7 data where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS7 data. Impact summary: An application...

CVE-2025-69420

Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An...

libcurl's ASN1 parser code has the GTime2str() function, used for parsing an ASN.1 (CVE-2024-7264)

A flaw was found in libcurl, where libcurl's ASN1 parser code has the GTime2str function, used for parsing an ASN.1 Generalized Time field. If a syntactically incorrect field is given, the parser can use -1 for the length of the time fraction , leading to a strlen performed on a pointer to a heap...

Advisory ROSA-SA-2026-3128

software: gnutls 3.8.10 OS: ROSA-CHROME unaffected versions = gnutls-3.8.10-1 affected versions gnutls-3.8.10-1 CVE-ID: CVE-2025-32988 BDU-ID: 2025-11076 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the asn1deletestructure function of the GnuTLS transport layer security library involves a memory...

K000159607: Node-forge vulnerability CVE-2025-12816

Security Advisory Description An interpretation-conflict CWE-436 vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic...

Security update for libtasn1

This update for libtasn1 fixes the following issues: CVE-2025-13151: stack-based buffer overflow in asn1expendoctetstring bsc1256341. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run t...

MiracleLinux 8 : perl-Convert-ASN1-0.27-18.el8 (AXSA:2024-8270:01)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2024-8270:01 advisory. perl-Convert-ASN1: allows remote attackers to cause an infinite loop via unexpected input CVE-2013-7488 Tenable has extracted the preceding description block...

MiracleLinux 7 : cups-1.6.3-51.el7 (AXSA:2020-557:05)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-557:05 advisory. cups: DNS rebinding attacks via incorrect whitelist CVE-2017-18190 cups: stack-buffer-overflow in libcups's asn1gettype function CVE-2019-8675 cups:...

MiracleLinux 8 : krb5-1.18.2-8.el8 (AXSA:2021-1843:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-1843:01 advisory. krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1encode.c may lead to DoS CVE-2020-28196 Tenable has extracted the...