Title: OpenSSL, Description: Resumen del problema: Analizar una estructura ASN.1 codificada en DER manipulada con un elemento primitivo cuyo contenido excede los 2 gigabytes de longitud puede causar una lectura excesiva del búfer de la pila (heap buffer over-read) en plataformas Unix y similares a Unix de 64 bits.

Resumen del impacto: La lectura excesiva del búfer de la pila puede bloquear la aplicación (Denegación de Servicio) o cargar en el objeto ASN.1 decodificado contenidos de memoria más allá del final del búfer de entrada. Más típicamente, tales elementos ASN.1 serían truncados en su lugar.

Un truncamiento de entero en el decodificador ASN.1 de OpenSSL hace que la longitud del contenido de un elemento primitivo ASN.1 sea manejada incorrectamente cuando excede los 2 gigabytes. En el peor de los casos, la longitud truncada se trata como una solicitud para escanear el contenido binario en busca de un byte cero de terminación, posiblemente causando que OpenSSL lea menos o más allá del final del búfer asignado.

Las aplicaciones que pasan datos suministrados por el atacante a d2i_X509(), d2i_PKCS7(), o cualquier otra función de decodificación d2i_* se ven afectadas. Las propias herramientas de línea de comandos de OpenSSL no son vulnerables, ya que los datos leídos a través de la capa BIO se verifican antes de que lleguen al código afectado. El problema solo afecta a plataformas Unix y similares a Unix de 64 bits; las plataformas de 32 bits y Windows de 64 bits no se ven afectadas.

Los módulos FIPS en 4.0, 3.6, 3.5, 3.4 y 3.0 no se ven afectados por este problema, ya que el código afectado está fuera del límite del módulo FIPS de OpenSSL.

{"timestamp":"2026-06-09T19:00:59.503895Z","id":"CVE-2026-34180","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"OpenSSL","product":"OpenSSL","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThan":"4.0.1","versionType":"semver","status":"affected"},{"version":"3.6.0","lessThan":"3.6.3","versionType":"semver","status":"affected"},{"version":"3.5.0","lessThan":"3.5.7","versionType":"semver","status":"affected"},{"version":"3.4.0","lessThan":"3.4.6","versionType":"semver","status":"affected"},{"version":"3.0.0","lessThan":"3.0.21","versionType":"semver","status":"affected"},{"version":"1.1.1","lessThan":"1.1.1zh","versionType":"custom","status":"affected"},{"version":"1.0.2","lessThan":"1.0.2zq","versionType":"custom","status":"affected"}]}]

OR
          *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.0.2 up to (excluding) 1.0.2zq
          *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.1.1 up to (excluding) 1.1.1zh
          *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.0.0 up to (excluding) 3.0.21
          *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.4.0 up to (excluding) 3.4.6
          *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.5.0 up to (excluding) 3.5.7
          *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.6.0 up to (excluding) 3.6.3
          *cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*

OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d Types: Patch

OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83 Types: Patch

OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff Types: Patch

OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43 Types: Patch

OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16 Types: Patch

OpenSSL Software Foundation: https://openssl-library.org/news/secadv/20260609.txt Types: Vendor Advisory

https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d

https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83

https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff

https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43

https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16

https://github.com/openssl/security/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d

https://github.com/openssl/security/commit/cbe418ae978539cf14a398a207dba834c0e93e83

https://github.com/openssl/security/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff

https://github.com/openssl/security/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43

https://github.com/openssl/security/commit/f696c73c3e61b8c502d040af62e690c060908a16

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive
element whose content exceeds 2 gigabytes in length may cause a heap buffer
over-read on 64-bit Unix and Unix-like platforms.

Impact summary: The heap buffer over-read may crash the application (Denial of
Service) or to load into the decoded ASN.1 object contents of memory beyond the
end of the input buffer.  More typically such ASN.1 elements would instead be
truncated.

An integer truncation in OpenSSL's ASN.1 decoder causes the content length of
an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the
worst case the truncated length is treated as a request to scan the binary
content for a terminating zero byte, possibly causing OpenSSL to read either
less than or beyond the end of the allocated buffer.

Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or
any other d2i_* decoding function are affected. OpenSSL's own command-line
tools are not vulnerable, as data read through the BIO layer is checked before
it reaches the affected code. The issue only affects 64-bit Unix and Unix-like
platforms; 32-bit platforms and 64-bit Windows are not affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,
as the affected code is outside the OpenSSL FIPS module boundary.

CWE-125

https://github.com/openssl/security/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d

https://github.com/openssl/security/commit/cbe418ae978539cf14a398a207dba834c0e93e83

https://github.com/openssl/security/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff

https://github.com/openssl/security/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43

https://github.com/openssl/security/commit/f696c73c3e61b8c502d040af62e690c060908a16

https://openssl-library.org/news/secadv/20260609.txt