CVE-2026-54697

The DER parser used for application-supplied private keys did not safely validate encoded length values before converting them to "Int" values or allocating arrays. A malformed private-key file could encode a length that overflowed or wrapped around, or request an allocation much larger than the...