CVE-2026-34181

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-34181
Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability. If a service accepting PKCS#12 files is using passwords for authenticating the received files, the attacker can create unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte, allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the service to accept a certificate and private key controlled by the attacker. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

7.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/openssl/openssl/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f Patch
https://github.com/openssl/openssl/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610 Patch
https://github.com/openssl/openssl/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7 Patch
https://github.com/openssl/openssl/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81 Patch
https://openssl-library.org/news/secadv/20260609.txt Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*
History

15 Jun 2026, 18:13

Type Values Removed Values Added
First Time Openssl openssl
Openssl
CPE cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
References () https://github.com/openssl/openssl/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f - () https://github.com/openssl/openssl/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f - Patch
References () https://github.com/openssl/openssl/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610 - () https://github.com/openssl/openssl/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610 - Patch
References () https://github.com/openssl/openssl/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7 - () https://github.com/openssl/openssl/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7 - Patch
References () https://github.com/openssl/openssl/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81 - () https://github.com/openssl/openssl/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81 - Patch
References () https://openssl-library.org/news/secadv/20260609.txt - () https://openssl-library.org/news/secadv/20260609.txt - Vendor Advisory

10 Jun 2026, 17:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.4

10 Jun 2026, 08:16

Type Values Removed Values Added
References
  • {'url': 'https://github.com/openssl/security/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f', 'source': 'openssl-security@openssl.org'}
  • {'url': 'https://github.com/openssl/security/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610', 'source': 'openssl-security@openssl.org'}
  • {'url': 'https://github.com/openssl/security/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7', 'source': 'openssl-security@openssl.org'}
  • {'url': 'https://github.com/openssl/security/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81', 'source': 'openssl-security@openssl.org'}
  • () https://github.com/openssl/openssl/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f -
  • () https://github.com/openssl/openssl/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610 -
  • () https://github.com/openssl/openssl/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7 -
  • () https://github.com/openssl/openssl/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81 -

09 Jun 2026, 17:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-09 17:17

Updated : 2026-06-17 10:38

NVD link : CVE-2026-34181

Mitre link : CVE-2026-34181

CVE.ORG link : CVE-2026-34181

JSON object : View

Products Affected

openssl

  • openssl
CWE
CWE-354

Improper Validation of Integrity Check Value