CVE-2026-34181 (GCVE-0-2026-34181)

Vulnerability from cvelistv5 – Published: 2026-06-09 16:03 – Updated: 2026-06-10 16:02
VLAI
Title
PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys
Summary
Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability. If a service accepting PKCS#12 files is using passwords for authenticating the received files, the attacker can create unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte, allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the service to accept a certificate and private key controlled by the attacker. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
Severity
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 16:01 UTC
CWE
  • CWE-354 - Improper Validation of Integrity Check Value
Assigner
References
Impacted products
Vendor Product Version CPE status
OpenSSL OpenSSL Affected: 4.0.0 , < 4.0.1 (semver)
Affected: 3.6.0 , < 3.6.3 (semver)
Affected: 3.5.0 , < 3.5.7 (semver)
Affected: 3.4.0 , < 3.4.6 (semver)
guessed Create a notification for this product.
Date Public
2026-06-09 14:00
Credits
Pavol Žáčik (Red Hat) Alex Gaynor (Anthropic) Alicja Kario (Red Hat)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-34181",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T16:01:11.685759Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T16:02:19.675Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.7",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.6",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Pavol \u017d\u00e1\u010dik (Red Hat)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alex Gaynor (Anthropic)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Alicja Kario (Red Hat)"
        }
      ],
      "datePublic": "2026-06-09T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue Summary: The PKCS#12 file processing fails to perform sufficient input\u003cbr\u003evalidation for files that use Password-Based Message Authentication Code 1\u003cbr\u003e(PBMAC1) integrity mechanism allowing a certificate and private key forgery.\u003cbr\u003e\u003cbr\u003eImpact Summary: An attacker impersonating a user can cause a service reading\u003cbr\u003ePKCS#12 files to accept forged certificates and private keys with a 1 in 256\u003cbr\u003eprobability.\u003cbr\u003e\u003cbr\u003eIf a service accepting PKCS#12 files is using passwords for authenticating\u003cbr\u003ethe received files, the attacker can create unencrypted PKCS#12 files that\u003cbr\u003euse PBMAC1 authentication that specifies an HMAC key of only one byte, allowing\u003cbr\u003ethem to craft a file that will be accepted with a 1 in 256 probability.\u003cbr\u003eThat would then cause the service to accept a certificate and private key\u003cbr\u003econtrolled by the attacker.\u003cbr\u003e\u003cbr\u003eThe FIPS modules are not affected by this issue, as the affected code is\u003cbr\u003eoutside the OpenSSL FIPS module boundary."
            }
          ],
          "value": "Issue Summary: The PKCS#12 file processing fails to perform sufficient input\nvalidation for files that use Password-Based Message Authentication Code 1\n(PBMAC1) integrity mechanism allowing a certificate and private key forgery.\n\nImpact Summary: An attacker impersonating a user can cause a service reading\nPKCS#12 files to accept forged certificates and private keys with a 1 in 256\nprobability.\n\nIf a service accepting PKCS#12 files is using passwords for authenticating\nthe received files, the attacker can create unencrypted PKCS#12 files that\nuse PBMAC1 authentication that specifies an HMAC key of only one byte, allowing\nthem to craft a file that will be accepted with a 1 in 256 probability.\nThat would then cause the service to accept a certificate and private key\ncontrolled by the attacker.\n\nThe FIPS modules are not affected by this issue, as the affected code is\noutside the OpenSSL FIPS module boundary."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-354",
              "description": "CWE-354 Improper Validation of Integrity Check Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T07:47:53.712Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260609.txt"
        },
        {
          "name": "4.0.1 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f"
        },
        {
          "name": "3.6.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81"
        },
        {
          "name": "3.5.7 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7"
        },
        {
          "name": "3.4.6 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-34181",
    "datePublished": "2026-06-09T16:03:22.065Z",
    "dateReserved": "2026-03-26T09:29:36.013Z",
    "dateUpdated": "2026-06-10T16:02:19.675Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-34181",
      "date": "2026-08-30",
      "epss": "0.00235",
      "percentile": "0.14347"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-23T14:51:26.000Z",
      "cve": "CVE-2026-34181",
      "id": "msrc_CVE-2026-34181",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:known_not_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-34181.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-34181\",\"sourceIdentifier\":\"openssl-security@openssl.org\",\"published\":\"2026-06-09T17:17:04.740\",\"lastModified\":\"2026-07-23T08:10:00.137\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Issue Summary: The PKCS#12 file processing fails to perform sufficient input\\nvalidation for files that use Password-Based Message Authentication Code 1\\n(PBMAC1) integrity mechanism allowing a certificate and private key forgery.\\n\\nImpact Summary: An attacker impersonating a user can cause a service reading\\nPKCS#12 files to accept forged certificates and private keys with a 1 in 256\\nprobability.\\n\\nIf a service accepting PKCS#12 files is using passwords for authenticating\\nthe received files, the attacker can create unencrypted PKCS#12 files that\\nuse PBMAC1 authentication that specifies an HMAC key of only one byte, allowing\\nthem to craft a file that will be accepted with a 1 in 256 probability.\\nThat would then cause the service to accept a certificate and private key\\ncontrolled by the attacker.\\n\\nThe FIPS modules are not affected by this issue, as the affected code is\\noutside the OpenSSL FIPS module boundary.\"},{\"lang\":\"es\",\"value\":\"Resumen del problema: El procesamiento de archivos PKCS#12 no realiza una validaci\u00f3n de entrada suficiente para archivos que utilizan el mecanismo de integridad Password-Based Message Authentication Code 1 (PBMAC1), lo que permite la falsificaci\u00f3n de un certificado y una clave privada.\\n\\nResumen del impacto: Un atacante suplantando a un usuario puede hacer que un servicio que lee archivos PKCS#12 acepte certificados y claves privadas falsificados con una probabilidad de 1 entre 256.\\n\\nSi un servicio que acepta archivos PKCS#12 est\u00e1 utilizando contrase\u00f1as para la autenticaci\u00f3n de los archivos recibidos, el atacante puede crear archivos PKCS#12 sin cifrar que utilizan autenticaci\u00f3n PBMAC1 que especifica una clave HMAC de solo un byte, permiti\u00e9ndoles crear un archivo que ser\u00e1 aceptado con una probabilidad de 1 entre 256. Eso entonces har\u00eda que el servicio acepte un certificado y una clave privada controlados por el atacante.\\n\\nLos m\u00f3dulos FIPS no se ven afectados por este problema, ya que el c\u00f3digo afectado est\u00e1 fuera del l\u00edmite del m\u00f3dulo FIPS de OpenSSL.\"}],\"affected\":[{\"source\":\"openssl-security@openssl.org\",\"affectedData\":[{\"vendor\":\"OpenSSL\",\"product\":\"OpenSSL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.0.0\",\"lessThan\":\"4.0.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.6.0\",\"lessThan\":\"3.6.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.5.0\",\"lessThan\":\"3.5.7\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.4.0\",\"lessThan\":\"3.4.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T16:01:11.685759Z\",\"id\":\"CVE-2026-34181\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"openssl-security@openssl.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-354\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.4.0\",\"versionEndExcluding\":\"3.4.6\",\"matchCriteriaId\":\"BF7E21E7-AEC0-4882-B1F1-2D056B506F22\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.5.0\",\"versionEndExcluding\":\"3.5.7\",\"matchCriteriaId\":\"6B6B9930-C549-4D88-9784-AF32CCDDB87A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.6.0\",\"versionEndExcluding\":\"3.6.3\",\"matchCriteriaId\":\"D41B3C45-EC73-4DC8-989D-B2E2792E102F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E881B9A-1A0A-4BC0-8160-20C00561167D\"}]}]}],\"references\":[{\"url\":\"https://github.com/openssl/openssl/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openssl/openssl/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openssl/openssl/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openssl/openssl/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://openssl-library.org/news/secadv/20260609.txt\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-27T05:49:57+00:00",
      "cve": "CVE-2026-34181",
      "id": "CVE-2026-34181",
      "initial_release_date": "2026-06-09T00:00:00+00:00",
      "product_status:fixed": "103",
      "product_status:known_affected": "33",
      "product_status:known_not_affected": "30",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34181.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-01T00:08:47Z",
      "cve": "CVE-2026-34181",
      "id": "CVE-2026-34181",
      "initial_release_date": "2026-06-13T02:21:17Z",
      "product_status:known_affected": "413",
      "product_status:known_not_affected": "443",
      "product_status:recommended": "38",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-34181",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-34181.json",
      "version": "6"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34181\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T16:01:11.685759Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-10T16:00:39.916Z\"}}], \"cna\": {\"title\": \"PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Pavol \\u017d\\u00e1\\u010dik (Red Hat)\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Alex Gaynor (Anthropic)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Alicja Kario (Red Hat)\"}], \"metrics\": [{\"other\": {\"type\": \"https://openssl-library.org/policies/general/security-policy/\", \"content\": {\"text\": \"Low\"}}, \"format\": \"other\"}], \"affected\": [{\"vendor\": \"OpenSSL\", \"product\": \"OpenSSL\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0.0\", \"lessThan\": \"4.0.1\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.6.0\", \"lessThan\": \"3.6.3\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.5.0\", \"lessThan\": \"3.5.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.4.0\", \"lessThan\": \"3.4.6\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-06-09T14:00:00.000Z\", \"references\": [{\"url\": \"https://openssl-library.org/news/secadv/20260609.txt\", \"name\": \"OpenSSL Advisory\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f\", \"name\": \"4.0.1 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81\", \"name\": \"3.6.3 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7\", \"name\": \"3.5.7 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610\", \"name\": \"3.4.6 git commit\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Issue Summary: The PKCS#12 file processing fails to perform sufficient input\\nvalidation for files that use Password-Based Message Authentication Code 1\\n(PBMAC1) integrity mechanism allowing a certificate and private key forgery.\\n\\nImpact Summary: An attacker impersonating a user can cause a service reading\\nPKCS#12 files to accept forged certificates and private keys with a 1 in 256\\nprobability.\\n\\nIf a service accepting PKCS#12 files is using passwords for authenticating\\nthe received files, the attacker can create unencrypted PKCS#12 files that\\nuse PBMAC1 authentication that specifies an HMAC key of only one byte, allowing\\nthem to craft a file that will be accepted with a 1 in 256 probability.\\nThat would then cause the service to accept a certificate and private key\\ncontrolled by the attacker.\\n\\nThe FIPS modules are not affected by this issue, as the affected code is\\noutside the OpenSSL FIPS module boundary.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Issue Summary: The PKCS#12 file processing fails to perform sufficient input\u003cbr\u003evalidation for files that use Password-Based Message Authentication Code 1\u003cbr\u003e(PBMAC1) integrity mechanism allowing a certificate and private key forgery.\u003cbr\u003e\u003cbr\u003eImpact Summary: An attacker impersonating a user can cause a service reading\u003cbr\u003ePKCS#12 files to accept forged certificates and private keys with a 1 in 256\u003cbr\u003eprobability.\u003cbr\u003e\u003cbr\u003eIf a service accepting PKCS#12 files is using passwords for authenticating\u003cbr\u003ethe received files, the attacker can create unencrypted PKCS#12 files that\u003cbr\u003euse PBMAC1 authentication that specifies an HMAC key of only one byte, allowing\u003cbr\u003ethem to craft a file that will be accepted with a 1 in 256 probability.\u003cbr\u003eThat would then cause the service to accept a certificate and private key\u003cbr\u003econtrolled by the attacker.\u003cbr\u003e\u003cbr\u003eThe FIPS modules are not affected by this issue, as the affected code is\u003cbr\u003eoutside the OpenSSL FIPS module boundary.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-354\", \"description\": \"CWE-354 Improper Validation of Integrity Check Value\"}]}], \"providerMetadata\": {\"orgId\": \"3a12439a-ef3a-4c79-92e6-6081a721f1e5\", \"shortName\": \"openssl\", \"dateUpdated\": \"2026-06-10T07:47:53.712Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-34181\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-10T16:02:19.675Z\", \"dateReserved\": \"2026-03-26T09:29:36.013Z\", \"assignerOrgId\": \"3a12439a-ef3a-4c79-92e6-6081a721f1e5\", \"datePublished\": \"2026-06-09T16:03:22.065Z\", \"assignerShortName\": \"openssl\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.