Catalogo CVE

CVE-2026-7383

Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may

[Catalogo CVE]

Gravità: High · CVSS 8.1
Published: Jun 9, 2026, 5:17:50 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.80% · Oct 22, 2026

Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a signed int: by left shift of the input character count for BMPSTRING (UTF-16) and UNIVERSALSTRING (UTF-32), and by summing per-character byte counts for UTF8STRING. The calculation overflows when the input reaches around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30 characters) the size wraps to zero, OPENSSL_malloc(1) is called, and the subsequent character copy writes several gigabytes past the one-byte allocation. X.509 certificate processing routes through ASN1_STRING_set_by_NID(), whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID size limits cap the input length; no network protocol or certificate-handling path in OpenSSL exercises the overflow. Triggering the bug requires an application that calls ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers a custom string type via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a gigabyte or more. For these reasons this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	openssl	sid	`3.6.5-1`	fixed
Debian	openssl	forky	`3.6.5-1`	fixed
Debian	openssl	trixie	`3.5.7-1~deb13u2`	fixed
Debian	openssl	trixie-security	`3.5.7-1~deb13u3`	fixed
Debian	openssl	bookworm	`3.0.20-1~deb12u2`	fixed
Debian	openssl	bookworm-security	`3.0.22-1~deb12u1`	fixed
Cpe	openssl	Not reported	`3.0.13-0ubuntu3.11`	fixed
Cpe	libssl-dev	Not reported	`3.0.13-0ubuntu3.11`	fixed
Cpe	libssl-doc	Not reported	`3.0.13-0ubuntu3.11`	fixed
Cpe	libssl3t64	Not reported	`3.0.13-0ubuntu3.11`	fixed
Cpe	openssl	Not reported	`1.0.2zq`	fixed
Cpe	openssl	Not reported	`1.1.1zh`	fixed
Cpe	openssl	Not reported	`3.0.21`	fixed
Cpe	openssl	Not reported	`3.4.6`	fixed
Cpe	openssl	Not reported	`3.5.7`	fixed
Cpe	openssl	Not reported	`3.6.3`	fixed
Cpe	openssl	Not reported	Not reported	unknown
Cpe	openssl	Not reported	`3.0.20-1~deb12u2`	fixed
Alpine	openssl	3.22	`3.5.7-r0`	fixed
Alpine	openssl	3.23	`3.5.7-r0`	fixed
Alpine	openssl	3.24	`3.5.7-r0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	openssl	source	sid	`3.6.3-1`	not yet assigned	Not reported	[1139674]
Debian	openssl	source	forky	`3.6.3-1`	not yet assigned	Not reported	[1139674]
Debian	openssl	source	trixie	`3.5.6-1~deb13u2`	not yet assigned	Not reported	[1139674]
Debian	openssl	source	bookworm	`3.0.20-1~deb12u2`	not yet assigned	Not reported	[1139674]
Cpe	openssl	cpe	Not reported	`3.0.13-0ubuntu3.11`	Not reported	Not reported	Not reported
Cpe	libssl-dev	cpe	Not reported	`3.0.13-0ubuntu3.11`	Not reported	Not reported	Not reported
Cpe	libssl-doc	cpe	Not reported	`3.0.13-0ubuntu3.11`	Not reported	Not reported	Not reported
Cpe	libssl3t64	cpe	Not reported	`3.0.13-0ubuntu3.11`	Not reported	Not reported	Not reported
Cpe	openssl	cpe	Not reported	`1.0.2zq`	Not reported	Not reported	Not reported
Cpe	openssl	cpe	Not reported	`1.1.1zh`	Not reported	Not reported	Not reported
Cpe	openssl	cpe	Not reported	`3.0.21`	Not reported	Not reported	Not reported
Cpe	openssl	cpe	Not reported	`3.4.6`	Not reported	Not reported	Not reported
Cpe	openssl	cpe	Not reported	`3.5.7`	Not reported	Not reported	Not reported
Cpe	openssl	cpe	Not reported	`3.6.3`	Not reported	Not reported	Not reported
Cpe	openssl	cpe	Not reported	`3.0.20-1~deb12u2`	Not reported	Not reported	Not reported
Alpine	openssl	apk	3.22	`3.5.7-r0`	Not reported	ALPINE-CVE-2026-7383	Not reported
Alpine	openssl	apk	3.23	`3.5.7-r0`	Not reported	ALPINE-CVE-2026-7383	Not reported
Alpine	openssl	apk	3.24	`3.5.7-r0`	Not reported	ALPINE-CVE-2026-7383	Not reported

[Debian bug #1139674]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libssl3]Interessata
Pacchetto sorgente: [openssl]
Dettagli (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Interessata · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Interessata · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
[libssl-dev]Interessata
Pacchetto sorgente: [openssl]
Dettagli (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Interessata · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Interessata · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
[libssl-doc]Interessata
Pacchetto sorgente: [openssl]
Dettagli (6)
- 3.0.20-1~deb12u2 · all · bookworm
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · all · bookworm
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · all · bookworm-security
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · all · bookworm-security
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · all · bookworm-updates
  Interessata · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · all · bookworm-updates
  Interessata · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
[openssl]Interessata
Dettagli (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Interessata · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Interessata · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12

[Debian 13 (Trixie)]

[libssl3t64]Corretta
Pacchetto sorgente: [openssl]
Dettagli (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
[libssl-dev]Corretta
Pacchetto sorgente: [openssl]
Dettagli (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
[libssl-doc]Corretta
Pacchetto sorgente: [openssl]
Dettagli (6)
- 3.5.6-1~deb13u2 · all · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · all · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · all · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · all · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · all · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · all · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
[openssl]Corretta
Dettagli (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
[openssl-provider-fips]Corretta
Pacchetto sorgente: [openssl]
Dettagli (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
[openssl-provider-legacy]Corretta
Pacchetto sorgente: [openssl]
Dettagli (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13

Osservato: Oct 23, 2026, 9:46:27 PM UTC

Riferimenti

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]