CVE-2026-34181
- Source
- https://cve.org/CVERecord?id=CVE-2026-34181
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-34181.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-34181
- Downstream
- Related
- Published
- 2026-06-09T16:03:22.065Z
- Modified
- 2026-07-17T21:03:51.779699654Z
- Severity
-
- 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys
- Details
-
Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery.
Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability.
If a service accepting PKCS#12 files is using passwords for authenticating the received files, the attacker can create unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte, allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the service to accept a certificate and private key controlled by the attacker.
The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
- Database specific
{ "cwe_ids": [ "CWE-354" ], "cna_assigner": "openssl", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34181.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34181.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-34181
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f
- https://github.com/openssl/openssl/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610
- https://github.com/openssl/openssl/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7
- https://github.com/openssl/openssl/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81
Affected packages
Git / github.com/openssl/openssl
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openssl/openssl
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedFixedFixedFixed
- Database specific
{ "extracted_events": [ { "introduced": "3.4.0" }, { "fixed": "3.4.6" }, { "introduced": "3.5.0" }, { "fixed": "3.5.7" }, { "introduced": "3.6.0" }, { "fixed": "3.6.3" }, { "introduced": "4.0.0-NA" }, { "last_affected": "4.0.0-NA" } ], "cpe": [ "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*" ], "source": [ "CPE_RANGE", "CPE_STRING", "REFERENCES" ] }
Affected versions
3.*
3.4-POST-CLANG-FORMAT-WEBKIT
3.4-PRE-CLANG-FORMAT-WEBKIT
3.5-POST-CLANG-FORMAT-WEBKIT
3.5-PRE-CLANG-FORMAT-WEBKIT
3.6-POST-CLANG-FORMAT-WEBKIT
3.6-PRE-CLANG-FORMAT-WEBKIT
4.*
4.0.0-NA
openssl-3.*
openssl-3.4.0
openssl-3.4.1
openssl-3.4.2
openssl-3.4.3
openssl-3.4.4
openssl-3.4.5
openssl-3.5.0
openssl-3.5.1
openssl-3.5.2
openssl-3.5.3
openssl-3.5.4
openssl-3.5.5
openssl-3.5.6
openssl-3.6.0
openssl-3.6.1
openssl-3.6.2
openssl-4.*
openssl-4.0.0
Database specific
vanir_signatures
[
{
"target": {
"file": "crypto/pkcs12/p12_mutl.c",
"function": "PBMAC1_PBKDF2_HMAC"
},
"id": "CVE-2026-34181-10a23314",
"signature_type": "Function",
"deprecated": false,
"source": "https://github.com/openssl/openssl/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7",
"signature_version": "v1",
"digest": {
"function_hash": "315812236523225321135455598472506362094",
"length": 1300.0
}
},
{
"target": {
"file": "crypto/pkcs12/p12_mutl.c",
"function": "PBMAC1_PBKDF2_HMAC"
},
"id": "CVE-2026-34181-179c423c",
"signature_type": "Function",
"deprecated": false,
"source": "https://github.com/openssl/openssl/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81",
"signature_version": "v1",
"digest": {
"function_hash": "315812236523225321135455598472506362094",
"length": 1300.0
}
},
{
"target": {
"file": "crypto/pkcs12/p12_mutl.c",
"function": "PBMAC1_PBKDF2_HMAC"
},
"id": "CVE-2026-34181-30fef3db",
"signature_type": "Function",
"deprecated": false,
"source": "https://github.com/openssl/openssl/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f",
"signature_version": "v1",
"digest": {
"function_hash": "76940837782890555457350612104326271031",
"length": 1377.0
}
},
{
"target": {
"file": "crypto/pkcs12/p12_mutl.c"
},
"id": "CVE-2026-34181-4b6dc014",
"signature_type": "Line",
"deprecated": false,
"source": "https://github.com/openssl/openssl/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7",
"signature_version": "v1",
"digest": {
"line_hashes": [
"279241462574763049619469167939590085965",
"124667758924786016762543144623160633643",
"19236051917043646048645916126187618535",
"231367928065682063288219806662093847496",
"49790318440299563265754245713723343566",
"277242367734218736396726487976444044573",
"147519211957771243650362882755125492373"
],
"threshold": 0.9
}
},
{
"target": {
"file": "crypto/pkcs12/p12_mutl.c"
},
"id": "CVE-2026-34181-caddfd8e",
"digest": {
"line_hashes": [
"279241462574763049619469167939590085965",
"124667758924786016762543144623160633643",
"19236051917043646048645916126187618535",
"231367928065682063288219806662093847496",
"49790318440299563265754245713723343566",
"277242367734218736396726487976444044573",
"147519211957771243650362882755125492373"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://github.com/openssl/openssl/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81",
"signature_version": "v1",
"signature_type": "Line"
},
{
"target": {
"file": "crypto/pkcs12/p12_mutl.c",
"function": "PBMAC1_PBKDF2_HMAC"
},
"id": "CVE-2026-34181-d817c3cb",
"signature_type": "Function",
"deprecated": false,
"source": "https://github.com/openssl/openssl/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610",
"signature_version": "v1",
"digest": {
"function_hash": "315812236523225321135455598472506362094",
"length": 1300.0
}
},
{
"target": {
"file": "crypto/pkcs12/p12_mutl.c"
},
"id": "CVE-2026-34181-dd5b877a",
"signature_type": "Line",
"deprecated": false,
"source": "https://github.com/openssl/openssl/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f",
"signature_version": "v1",
"digest": {
"line_hashes": [
"279241462574763049619469167939590085965",
"124667758924786016762543144623160633643",
"19236051917043646048645916126187618535",
"109311854025605999266541078181181050843",
"233208125156034602449654152202759626898",
"50266223505594140671587537528415171907",
"183383251099508880019909697272539267262",
"148499316838314248044771824359462163836"
],
"threshold": 0.9
}
},
{
"target": {
"file": "crypto/pkcs12/p12_mutl.c"
},
"id": "CVE-2026-34181-f1fe0dd4",
"signature_type": "Line",
"deprecated": false,
"source": "https://github.com/openssl/openssl/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610",
"signature_version": "v1",
"digest": {
"line_hashes": [
"279241462574763049619469167939590085965",
"124667758924786016762543144623160633643",
"19236051917043646048645916126187618535",
"231367928065682063288219806662093847496",
"49790318440299563265754245713723343566",
"277242367734218736396726487976444044573",
"147519211957771243650362882755125492373"
],
"threshold": 0.9
}
}
]
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-34181.json"
vanir_signatures_modified
"2026-07-15T00:58:52Z"