JLSEC-2026-232
- Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-232.md
- Import Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-232.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/JLSEC-2026-232
- Upstream
- Published
- 2026-04-27T18:33:55.942Z
- Modified
- 2026-07-25T18:24:42.739031680Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- openssl-src contains Double free after calling `PEM_read_bio_ex`
- Details
-
The function
PEM_read_bio_ex()reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this casePEM_read_bio_ex()will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack.The functions
PEM_read_bio()andPEM_read()are simple wrappers aroundPEM_read_bio_ex()and therefore these functions are also directly affected.These functions are also called indirectly by a number of other OpenSSL functions including
PEM_X509_INFO_read_bio_ex()andSSL_CTX_use_serverinfo_file()which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument ifPEM_read_bio_ex()returns a failure code. These locations include thePEM_read_bio_TYPE()functions as well as the decoders introduced in OpenSSL 3.0.The OpenSSL asn1parse command line application is also impacted by this issue.
- Database specific
{ "license": "CC-BY-4.0", "sources": [ { "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-4450", "modified": "2026-06-17T05:20:54.027Z", "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4450", "published": "2023-02-08T20:15:23.973Z", "database_specific": { "status": "Modified" }, "imported": "2026-07-17T21:25:27.872Z", "id": "CVE-2022-4450" }, { "url": "https://api.github.com/advisories/GHSA-v5w6-wcm8-jm4q", "modified": "2025-11-04T22:08:19Z", "html_url": "https://github.com/advisories/GHSA-v5w6-wcm8-jm4q", "published": "2023-02-08T22:22:58Z", "imported": "2026-07-17T21:25:28.034Z", "id": "GHSA-v5w6-wcm8-jm4q" }, { "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2023-0796", "modified": "2025-11-04T19:14:13Z", "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-0796", "imported": "2026-07-17T21:25:38.192Z", "published": "2023-02-08T19:04:04Z", "id": "EUVD-2023-0796" } ] }- References
-
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=63bcf189be73a9cc1264059bed6f57974be74a83
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=bbcf509bd046b34cca19c766bbddc31683d0858b
- https://github.com/advisories/GHSA-v5w6-wcm8-jm4q
- https://nvd.nist.gov/vuln/detail/CVE-2022-4450
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003
- https://rustsec.org/advisories/RUSTSEC-2023-0010.html
- https://security.gentoo.org/glsa/202402-08
- https://www.openssl.org/news/secadv/20230207.txt
- Credits
-
-
- michaelkedar - ANALYST
-