CVE-2026-106464
computes the certificate signature's length as without first checking that is non-zero.
Published Oct 14, 2026 · updated Oct 15, 2026
computes the certificate signature's length as without first checking that is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
computes the certificate signature's length as without first checking that is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticate
Oct 15, 2026 · NIST NVD
Updated
computes the certificate signature's length as without first checking that is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticate
Sources
- CVE.orgVulnerability recordCVE-2026-106464
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-106464
30-day exploitation probability 0.2%
first.org - NIST NVDVulnerability recordCVE-2026-106464
computes the certificate signature's length as without first checking that is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding
nvd.nist.gov