JLSEC-2026-221

See a problem?
Please try reporting it to the source first.
Source
https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-221.md
Import Source
https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-221.json
JSON Data
https://api.test.osv.dev/v1/vulns/JLSEC-2026-221
Upstream
  • EUVD-2021-1843
Published
2026-04-27T18:33:55.942Z
Modified
2026-04-27T20:32:29.109550788Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Integer Overflow in openssl-src
Details

Calls to EVPCipherUpdate, EVPEncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Database specific 
{
    "sources": [
        {
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23840",
            "modified": "2026-04-16T15:16:45.010Z",
            "published": "2021-02-16T17:15:13.300Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-23840",
            "imported": "2026-04-27T16:32:28.543Z",
            "database_specific": {
                "status": "Modified"
            },
            "id": "CVE-2021-23840"
        },
        {
            "modified": "2023-04-03T19:11:21Z",
            "published": "2021-08-25T20:52:19Z",
            "url": "https://api.github.com/advisories/GHSA-qgm6-9472-pwq7",
            "html_url": "https://github.com/advisories/GHSA-qgm6-9472-pwq7",
            "imported": "2026-04-27T16:35:40.555Z",
            "id": "GHSA-qgm6-9472-pwq7"
        },
        {
            "modified": "2026-04-16T14:12:36Z",
            "published": "2021-02-16T16:55:18Z",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2021-1843",
            "imported": "2026-04-27T16:32:58.176Z",
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1843",
            "id": "EUVD-2021-1843"
        }
    ],
    "license": "CC-BY-4.0"
}
References
Credits

Affected packages

Julia / OpenSSL_jll

Package

Name
OpenSSL_jll
Purl
pkg:julia/OpenSSL_jll?uuid=458c3c95-2e84-50aa-8efc-19380b2a3a95

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.10+0

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-221.json"

Julia / Openresty_jll

Package

Name
Openresty_jll
Purl
pkg:julia/Openresty_jll?uuid=87da34d4-7b1b-5a94-8376-8cb65bf3132c

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.19.9+0

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-221.json"