Input validation error in OpenSSL - CVE-2026-34181

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU134279

Input validation error in OpenSSL - CVE-2026-34181

Published: June 10, 2026


Vulnerability identifier: #VU134279
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-34181
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to impersonate a user.

The vulnerability exists due to improper input validation in PKCS#12 file processing for PBMAC1 integrity verification when processing unencrypted PKCS#12 files with a one-byte HMAC key. A remote attacker can submit a crafted PKCS#12 file to impersonate a user.

The forged file is accepted with a 1 in 256 probability.


Affected software

OpenSSL
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Fedora
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
FreeBSD
Basesystem Module
Ubuntu
IBM Cloud Pak for Data System
IBM MQ Operator
LANTIME Operating System Firmware (LTOS)
IBM supplied MQ Advanced container images
Operator for PostgreSQL
EntireX
openssl (Ubuntu package)
openssl (Debian package)
openssl-3-debuginfo
libopenssl-3-fips-provider-32bit
libopenssl3-32bit
libopenssl-3-fips-provider-32bit-debuginfo
libopenssl3-32bit-debuginfo
openssl-3
libopenssl-3-fips-provider-debuginfo
libopenssl3
libopenssl-3-devel
libopenssl3-debuginfo
openssl-3-debugsource
libopenssl-3-fips-provider
openssl (Red Hat package)
openssl3
openssl

How to mitigate CVE-2026-34181

Install security update from vendor's website.

OpenSSL - addressed in versions 3.4.6, 3.5.7, 3.6.3, 4.0.1
IBM Cloud Pak for Data System - update to 8.10.26.07.SP3
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
LANTIME Operating System Firmware (LTOS) - update to 7.10.013
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
EntireX - update to 12.1 Fix2
openssl (Ubuntu package) - addressed in versions 3.0.2-0ubuntu1.25, 3.0.13-0ubuntu3.11, 3.5.3-1ubuntu3.4, 3.5.5-1ubuntu3.2
openssl (Debian package) - addressed in versions 3.0.20-1~deb12u2, 3.5.6-1~deb13u2
openssl-3-debuginfo - addressed in versions 3.2.3-150700.5.36.1, 3.5.0-150700.5.50.1
libopenssl-3-fips-provider-32bit - addressed in versions 3.2.3-150700.5.36.1, 3.5.0-150700.5.50.1
libopenssl3-32bit - addressed in versions 3.2.3-150700.5.36.1, 3.5.0-150700.5.50.1
libopenssl-3-fips-provider-32bit-debuginfo - addressed in versions 3.2.3-150700.5.36.1, 3.5.0-150700.5.50.1
libopenssl3-32bit-debuginfo - addressed in versions 3.2.3-150700.5.36.1, 3.5.0-150700.5.50.1
openssl-3 - addressed in versions 3.2.3-150700.5.36.1, 3.5.0-150700.5.50.1
libopenssl-3-fips-provider-debuginfo - addressed in versions 3.2.3-150700.5.36.1, 3.5.0-150700.5.50.1
libopenssl3 - addressed in versions 3.2.3-150700.5.36.1, 3.5.0-150700.5.50.1
libopenssl-3-devel - addressed in versions 3.2.3-150700.5.36.1, 3.5.0-150700.5.50.1
libopenssl3-debuginfo - addressed in versions 3.2.3-150700.5.36.1, 3.5.0-150700.5.50.1
openssl-3-debugsource - addressed in versions 3.2.3-150700.5.36.1, 3.5.0-150700.5.50.1
libopenssl-3-fips-provider - addressed in versions 3.2.3-150700.5.36.1, 3.5.0-150700.5.50.1
openssl (Red Hat package) - addressed in versions 3.5.5-4.el9_8, 3.5.5-4.el10_2
openssl3 - update to 3.5.5-5.el8
openssl - update to 3.5.7-1.fc44

External References

Related Security Bulletins