ASN.1 Validation Flaw in Picotls TLS Library Affects Crypto Operations
CVE-2026-45271

5.5MEDIUM

Key Information:

Vendor

H2o

Status
Picotls
Vendor
CVE Published:
21 August 2026

What is CVE-2026-45271?

A flaw in the Picotls TLS protocol library's ASN.1 validation helper can lead to application crashes caused by deep recursion in nested ASN.1 elements. When using the minicrypto backend to parse untrusted PKCS#8 private keys, an attacker can craft deeply nested structures that exhaust the process stack. This vulnerability can be exploited when applications call the ptls_minicrypto_load_private_key() function with malicious input. However, implementations using the libcrypto (OpenSSL) backend remain unaffected. The issue has been addressed in a specific commit to the Picotls repository.

Affected Version(s)

picotls < c14231d801407640bc42c2dcf92783409ea6a7c7

References

https://github.com/h2o/picotls/security/advisories/GHSA-8...
x_refsource_CONFIRM
https://github.com/h2o/picotls/commit/c14231d801407640bc4...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.