CVE catalog
CVE-2026-40253
openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no
- Severity
- Medium · CVSS 6.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.16% · Oct 25, 2026
openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer length parameter, and trust attacker-controlled BER length fields without validating them against actual buffer boundaries. All primitive decoders are affected: ber_decode_INTEGER, ber_decode_SEQUENCE, ber_decode_OCTET_STRING, ber_decode_BIT_STRING, and ber_decode_CHOICE. Additionally, ber_decode_INTEGER can produce integer underflows when the encoded length is zero. An attacker supplying a malformed BER-encoded cryptographic object through PKCS#11 operations such as C_CreateObject or C_UnwrapKey, token loading from disk, or remote backend communication can trigger out-of-bounds reads. This affects all token backends (Soft, ICA, CCA, TPM, EP11, ICSF) since the vulnerable code is in the shared common library. A patch is available thorugh commit ed378f463ef73364c89feb0fc923f4dc867332a3.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | opencryptoki | sid | 3.27.0-1 | fixed |
| Debian | opencryptoki | forky | 3.27.0-1 | fixed |
| Debian | opencryptoki | trixie | 3.23.0+dfsg-0.3+deb13u1 | fixed |
| Debian | opencryptoki | bookworm | 3.8.1+dfsg-3.2 | vulnerable |
| Cpe | opencryptoki | Not reported | Not reported | vulnerable |
| Cpe | opencryptoki | Not reported | Not reported | unknown |
| Ubuntu | opencryptoki | noble | 3.23.0+dfsg-0ubuntu3.1 | fixed |
| Ubuntu | libopencryptoki-dev | noble | 3.23.0+dfsg-0ubuntu3.1 | fixed |
| Ubuntu | libopencryptoki0 | noble | 3.23.0+dfsg-0ubuntu3.1 | fixed |
| Suse | openCryptoki | linux enterprise server 12 sp5-ltss | 3.17.0-5.24.1 | fixed |
| Ubuntu | opencryptoki | 16.04 | 2.3.1+dfsg-3ubuntu5 | vulnerable |
| Ubuntu | opencryptoki | 16.04 | 3.4.1+dfsg-1ubuntu1 | vulnerable |
| Ubuntu | opencryptoki | 16.04 | 3.4.1+dfsg-1ubuntu2 | vulnerable |
| Ubuntu | opencryptoki | 16.04 | 3.4.1+dfsg-1ubuntu3 | vulnerable |
| Ubuntu | opencryptoki | 16.04 | 3.4.1+dfsg-1ubuntu4 | vulnerable |
| Ubuntu | opencryptoki | 16.04 | 3.4.1+dfsg-1ubuntu4.1 | vulnerable |
| Ubuntu | opencryptoki | 18.04 | 3.7.0+dfsg-4 | vulnerable |
| Ubuntu | opencryptoki | 18.04 | 3.8.1+dfsg-2 | vulnerable |
| Ubuntu | opencryptoki | 18.04 | 3.8.1+dfsg-3 | vulnerable |
| Ubuntu | opencryptoki | 18.04 | 3.8.2+dfsg-0ubuntu1 | vulnerable |
| Ubuntu | opencryptoki | 18.04 | 3.9.0+dfsg-0ubuntu1 | vulnerable |
| Ubuntu | opencryptoki | 18.04 | 3.9.0+dfsg-0ubuntu1.1 | vulnerable |
| Ubuntu | opencryptoki | 18.04 | 3.9.0+dfsg-0ubuntu1.2 | vulnerable |
| Ubuntu | opencryptoki | 18.04 | 3.9.0+dfsg-0ubuntu1.3 | vulnerable |
| Ubuntu | opencryptoki | 18.04 | 3.9.0+dfsg-0ubuntu1.4 | vulnerable |
| Ubuntu | opencryptoki | 20.04 | 3.11.1+dfsg-0ubuntu2 | vulnerable |
| Ubuntu | opencryptoki | 20.04 | 3.11.1+dfsg-0ubuntu3 | vulnerable |
| Ubuntu | opencryptoki | 20.04 | 3.12.1+dfsg-0ubuntu1 | vulnerable |
| Ubuntu | opencryptoki | 20.04 | 3.13.0+dfsg-0ubuntu4 | vulnerable |
| Ubuntu | opencryptoki | 20.04 | 3.13.0+dfsg-0ubuntu5 | vulnerable |
| Ubuntu | opencryptoki | 20.04 | 3.13.0+dfsg-0ubuntu5.1 | vulnerable |
| Ubuntu | opencryptoki | 20.04 | 3.13.0+dfsg-0ubuntu5.2 | vulnerable |
| Ubuntu | opencryptoki | 22.04 | 3.16.0+dfsg-0ubuntu1 | vulnerable |
| Ubuntu | opencryptoki | 22.04 | 3.16.0+dfsg-0ubuntu2 | vulnerable |
| Ubuntu | opencryptoki | 22.04 | 3.16.0+dfsg-0ubuntu3 | vulnerable |
| Ubuntu | opencryptoki | 22.04 | 3.17.0+dfsg+20220202.b40982e-0ubuntu1 | vulnerable |
| Ubuntu | opencryptoki | 22.04 | 3.17.0+dfsg+20220202.b40982e-0ubuntu1.1 | vulnerable |
| Ubuntu | opencryptoki | 22.04 | 3.17.0+dfsg+20220202.b40982e-0ubuntu1.2 | vulnerable |
| Ubuntu | opencryptoki | 22.04 | 3.17.0+dfsg+20220202.b40982e-0ubuntu1.3 | fixed |
| Ubuntu | opencryptoki | 24.04 | 3.21.0+dfsg-0ubuntu1 | vulnerable |
| Ubuntu | opencryptoki | 24.04 | 3.21.0+dfsg-0ubuntu2 | vulnerable |
| Ubuntu | opencryptoki | 24.04 | 3.22.0+dfsg-0ubuntu1 | vulnerable |
| Ubuntu | opencryptoki | 24.04 | 3.23.0+dfsg-0ubuntu1 | vulnerable |
| Ubuntu | opencryptoki | 24.04 | 3.23.0+dfsg-0ubuntu2 | vulnerable |
| Ubuntu | opencryptoki | 24.04 | 3.23.0+dfsg-0ubuntu3 | vulnerable |
| Ubuntu | opencryptoki | 24.04 | 3.23.0+dfsg-0ubuntu3.1 | fixed |
| Ubuntu | opencryptoki | 25.10 | 3.24.0+git20250128.0462717+dfsg-0ubuntu1 | vulnerable |
| Ubuntu | opencryptoki | 25.10 | 3.25.0+dfsg-0ubuntu1 | vulnerable |
| Ubuntu | opencryptoki | 26.04 | 3.25.0+dfsg-0ubuntu1 | vulnerable |
| Ubuntu | opencryptoki | 26.04 | 3.26.0+dfsg-0ubuntu1 | vulnerable |
| Ubuntu | opencryptoki | 26.04 | 3.26.0+dfsg-0ubuntu1.1 | fixed |
| Suse | openCryptoki | linux enterprise module for server applications 15 sp7 | 3.26.0-150700.5.17.1 | fixed |
| Suse | openCryptoki | linux enterprise server ltss extended security 12 sp5 | 3.17.0-5.24.1 | fixed |
| Suse | openCryptoki | linux enterprise micro 5.4 | 3.17.0-150400.4.16.1 | fixed |
| Opensuse | openCryptoki | tumbleweed | 3.26.0-6.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | opencryptoki | source | sid | 3.27.0-1 | not yet assigned | Not reported | [1136019] |
| Debian | opencryptoki | source | forky | 3.27.0-1 | not yet assigned | Not reported | [1136019] |
| Debian | opencryptoki | source | trixie | 3.23.0+dfsg-0.3+deb13u1 | not yet assigned | Not reported | [1136019] |
| Debian | opencryptoki | source | bookworm | (unfixed) | not yet assigned | Not reported | [1136019] |
| Ubuntu | opencryptoki | deb | noble | 3.23.0+dfsg-0ubuntu3.1 | Not reported | Not reported | Not reported |
| Ubuntu | libopencryptoki-dev | deb | noble | 3.23.0+dfsg-0ubuntu3.1 | Not reported | Not reported | Not reported |
| Ubuntu | libopencryptoki0 | deb | noble | 3.23.0+dfsg-0ubuntu3.1 | Not reported | Not reported | Not reported |
| Suse | openCryptoki | rpm | linux enterprise server 12 sp5-ltss | 3.17.0-5.24.1 | Not reported | SUSE-SU-2026:2685-2 | Not reported |
| Ubuntu | opencryptoki | deb | 22.04 | 3.17.0+dfsg+20220202.b40982e-0ubuntu1.3 | Not reported | UBUNTU-CVE-2026-40253 | Not reported |
| Ubuntu | opencryptoki | deb | 24.04 | 3.23.0+dfsg-0ubuntu3.1 | Not reported | UBUNTU-CVE-2026-40253 | Not reported |
| Ubuntu | opencryptoki | deb | 26.04 | 3.26.0+dfsg-0ubuntu1.1 | Not reported | UBUNTU-CVE-2026-40253 | Not reported |
| Suse | openCryptoki | rpm | linux enterprise module for server applications 15 sp7 | 3.26.0-150700.5.17.1 | Not reported | SUSE-SU-2026:2757-1 | Not reported |
| Suse | openCryptoki | rpm | linux enterprise server ltss extended security 12 sp5 | 3.17.0-5.24.1 | Not reported | SUSE-SU-2026:2685-1 | Not reported |
| Suse | openCryptoki | rpm | linux enterprise micro 5.4 | 3.17.0-150400.4.16.1 | Not reported | SUSE-SU-2026:2355-1 | Not reported |
| Opensuse | openCryptoki | rpm | tumbleweed | 3.26.0-6.1 | Not reported | OPENSUSE-SU-2026:10593-1 | Not reported |
Notes
[bookworm] opencryptoki: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libopencryptoki0]Affected
Source package: [opencryptoki]
Details (2)
3.8.1+dfsg-3.2+b3· amd64 · bookwormAffected
nvd · opencryptoki · debian · bookworm; nvd · opencryptoki · debian · 12
3.8.1+dfsg-3.2+b3· arm64 · bookwormAffected
nvd · opencryptoki · debian · bookworm; nvd · opencryptoki · debian · 12
- [libopencryptoki-dev]Affected
Source package: [opencryptoki]
Details (2)
3.8.1+dfsg-3.2+b3· amd64 · bookwormAffected
nvd · opencryptoki · debian · bookworm; nvd · opencryptoki · debian · 12
3.8.1+dfsg-3.2+b3· arm64 · bookwormAffected
nvd · opencryptoki · debian · bookworm; nvd · opencryptoki · debian · 12
- [opencryptoki]Affected
Source package: [opencryptoki]
Details (2)
3.8.1+dfsg-3.2+b3· amd64 · bookwormAffected
nvd · opencryptoki · debian · bookworm; nvd · opencryptoki · debian · 12
3.8.1+dfsg-3.2+b3· arm64 · bookwormAffected
nvd · opencryptoki · debian · bookworm; nvd · opencryptoki · debian · 12
[Debian 13 (Trixie)]
- [libopencryptoki0]Affected
Source package: [opencryptoki]
Details (2)
3.23.0+dfsg-0.3+b2· amd64 · trixieAffected · Fixed:
3.23.0+dfsg-0.3+deb13u1nvd · opencryptoki · debian · 13
3.23.0+dfsg-0.3+b2· arm64 · trixieAffected · Fixed:
3.23.0+dfsg-0.3+deb13u1nvd · opencryptoki · debian · 13
- [libopencryptoki-dev]Affected
Source package: [opencryptoki]
Details (2)
3.23.0+dfsg-0.3+b2· amd64 · trixieAffected · Fixed:
3.23.0+dfsg-0.3+deb13u1nvd · opencryptoki · debian · 13
3.23.0+dfsg-0.3+b2· arm64 · trixieAffected · Fixed:
3.23.0+dfsg-0.3+deb13u1nvd · opencryptoki · debian · 13
- [opencryptoki]Affected
Source package: [opencryptoki]
Details (2)
3.23.0+dfsg-0.3+b2· amd64 · trixieAffected · Fixed:
3.23.0+dfsg-0.3+deb13u1nvd · opencryptoki · debian · 13
3.23.0+dfsg-0.3+b2· arm64 · trixieAffected · Fixed:
3.23.0+dfsg-0.3+deb13u1nvd · opencryptoki · debian · 13
[openSUSE Tumbleweed]
- [openCryptoki-64bit]Unknown
Source package: [openCryptoki]
Details (1)
3.27.0-3.2· x86_64 · tumbleweedUnknown · Fixed:
3.26.0-6.1Version impact unknown
nvd · openCryptoki · opensuse · tumbleweed
- [openCryptoki-devel]Unknown
Source package: [openCryptoki]
Details (1)
3.27.0-3.2· x86_64 · tumbleweedUnknown · Fixed:
3.26.0-6.1Version impact unknown
nvd · openCryptoki · opensuse · tumbleweed
- [openCryptoki]Fixed
Source package: [openCryptoki]
Details (1)
3.27.0-3.2· x86_64 · tumbleweedFixed · Fixed:
3.26.0-6.1nvd · openCryptoki · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_28231.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-40253]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-40253]
- [https://osv.dev/vulnerability/SUSE-SU-2026:2355-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:2685-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:2685-2]
- [https://osv.dev/vulnerability/SUSE-SU-2026:2757-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-40253]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10593-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-40253]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40253.json]
- [https://ubuntu.com/security/notices/USN-8686-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1957.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]