JLSEC-2026-246

See a problem?
Please try reporting it to the source first.
Source
https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-246.md
Import Source
https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-246.json
JSON Data
https://api.test.osv.dev/v1/vulns/JLSEC-2026-246
Upstream
  • EUVD-2023-58483
  • GHSA-hvc4-mjv4-5mw6
Published
2026-04-27T18:33:55.942Z
Modified
2026-07-25T18:24:46.141336618Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Issue summary: Checking excessively long invalid RSA public keys may take a long time.
Details

Issue summary: Checking excessively long invalid RSA public keys may take a long time.

Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may lead to a Denial of Service.

When function EVP_PKEY_public_check() is called on RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two or more large primes and this computation completes quickly. However, if n is an overly large prime, then this computation would take a long time.

An application that calls EVP_PKEY_public_check() and supplies an RSA key obtained from an untrusted source could be vulnerable to a Denial of Service attack.

The function EVP_PKEY_public_check() is not called from other OpenSSL functions however it is called from the OpenSSL pkey command line application. For that reason that application is also vulnerable if used with the '-pubin' and '-check' options on untrusted data.

The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.

Database specific 
{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "published": "2024-04-25T07:15:45.270Z",
            "imported": "2026-07-17T21:27:56.972Z",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6237",
            "id": "CVE-2023-6237",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-6237",
            "modified": "2026-06-17T06:50:21.877Z",
            "database_specific": {
                "status": "Deferred"
            }
        },
        {
            "published": "2024-04-25T09:32:09Z",
            "url": "https://api.github.com/advisories/GHSA-hvc4-mjv4-5mw6",
            "html_url": "https://github.com/advisories/GHSA-hvc4-mjv4-5mw6",
            "id": "GHSA-hvc4-mjv4-5mw6",
            "imported": "2026-07-17T21:27:57.117Z",
            "modified": "2026-05-12T12:31:42Z"
        },
        {
            "published": "2024-04-25T06:27:26Z",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2023-58483",
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-58483",
            "id": "EUVD-2023-58483",
            "imported": "2026-07-17T21:28:07.533Z",
            "modified": "2026-05-12T10:41:05Z"
        }
    ]
}
References

Affected packages

Julia / OpenSSL_jll

Package

Name
OpenSSL_jll
Purl
pkg:julia/OpenSSL_jll?uuid=458c3c95-2e84-50aa-8efc-19380b2a3a95

Affected ranges

Type
SEMVER
Events
Introduced
3.0.8+0
Fixed
3.0.13+0

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-246.json"