CVE-2026-34610

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34610
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34610.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34610
Aliases
  • GHSA-636g-jxv4-v4gr
Downstream
Related
Published
2026-04-02T17:54:53Z
Modified
2026-08-12T15:33:38Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
leancrypto: Integer truncation in X.509 name parser enables certificate identity impersonation
Details

The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms. Prior to version 1.7.1, lc_x509_extract_name_segment() casts size_t vlen to uint8_t when storing the Common Name (CN) length. An attacker who crafts a certificate with CN = victim's CN + 256 bytes padding gets cn_size = (uint8_t)(256 + N) = N, where N is the victim's CN length. The first N bytes of the attacker's CN are the victim's identity. After parsing, the attacker's certificate has an identical CN to the victim's — enabling identity impersonation in PKCS#7 verification, certificate chain matching, and code signing. This issue has been patched in version 1.7.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-681"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34610.json"
}
References

Affected packages

Git / github.com/smuellerdd/leancrypto

Affected ranges

Type
GIT
Repo
https://github.com/smuellerdd/leancrypto
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e7fa8c87a46c5787174c18fac385aa08eecdedd1
Fixed
5cdcbe12bd6c3d6e87e969972a580b44a74c3a6a
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:leancrypto:leancrypto:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.7.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.11.0
v0.3.0
v0.4.0
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.6.0
v0.7.0
v0.8.0
v0.9.0
v0.9.1
v0.9.2
v1.*
v1.0.0
v1.0.1
v1.1.0
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.5.1
v1.6.0
v1.7.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34610.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "124191862719956782558136961530273640974",
                "200797749888053937735051491502027892542",
                "265433056675998543758919315339258404678",
                "81731644021144318313444816115742547410",
                "193110942495680251507657668675947654761",
                "99119703350586295205780449598396500165",
                "158301691224047526824146594388587688188",
                "138403378418395875564693432982442128898",
                "6167116348499338671957640894445413571",
                "100276054511506642986565156091548849555",
                "173188776841251032524955959483760296330",
                "181708719538056443125126224615507362700",
                "24393858040284068398688464978566042079",
                "185856003732619017566339406583390629253",
                "17588188155811904603627968064520408735",
                "134701196775781236352038600315809454955",
                "94052653544298409205828025784539587413",
                "232475296642114060501983599006898665922",
                "48272921591686728124261330057821041847",
                "224139352403840643025745003683826944109",
                "93239745015414764020561022174125778472",
                "75416592499183447016930192859825864038",
                "4133724299083108568819183880540298125",
                "299500991761005054580268627648317620657",
                "44992837790998201866048821333747739680",
                "75416592499183447016930192859825864038",
                "4133724299083108568819183880540298125",
                "299500991761005054580268627648317620657",
                "44992837790998201866048821333747739680",
                "327843279686952144466643060719860557560",
                "21461895812082296728381926349091699118",
                "73946607311445223402540766680461695992",
                "253802515548344564395965901386712199128",
                "296358550953724600872628322422067633216",
                "310380010046564596575595719156122650678",
                "201250352444809683931279755445871892005",
                "145232191078632187177348959553507322928",
                "20944217715472891952363433420087798090",
                "199467862868328396205287265907616633703",
                "315093829086827002859632132461033551165",
                "146074784206677649160447542667957206609",
                "24742244162306987115250596855156776674",
                "165333545913671750400265760502251592138",
                "27649748978033403302523921132698692765",
                "213559923841562864222725572028319792072",
                "313997520397666585040700013946523737564",
                "124475351102755474160529646534393606761"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-34610-037e29f8",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/smuellerdd/leancrypto/commit/5cdcbe12bd6c3d6e87e969972a580b44a74c3a6a",
        "target": {
            "file": "apps/src/lc_x509_generator_checker.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "95621512291603765487214232841369329927",
            "length": 2802
        },
        "id": "CVE-2026-34610-2a1de38a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/smuellerdd/leancrypto/commit/5cdcbe12bd6c3d6e87e969972a580b44a74c3a6a",
        "target": {
            "file": "asn1/src/x509_cert_parser.c",
            "function": "x509_fabricate_name"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "199579829852206154320206206663427827936",
            "length": 335
        },
        "id": "CVE-2026-34610-2c44093b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/smuellerdd/leancrypto/commit/5cdcbe12bd6c3d6e87e969972a580b44a74c3a6a",
        "target": {
            "file": "asn1/src/x509_cert_parser.c",
            "function": "lc_x509_san_email"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "205589613250558479195109282245066229891",
            "length": 479
        },
        "id": "CVE-2026-34610-3e13c076",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/smuellerdd/leancrypto/commit/5cdcbe12bd6c3d6e87e969972a580b44a74c3a6a",
        "target": {
            "file": "asn1/src/x509_cert_parser.c",
            "function": "lc_x509_note_issuer"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "255670291389672619986150367735584089117",
            "length": 9320
        },
        "id": "CVE-2026-34610-522f19ba",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/smuellerdd/leancrypto/commit/5cdcbe12bd6c3d6e87e969972a580b44a74c3a6a",
        "target": {
            "file": "apps/src/lc_x509_generator_checker.c",
            "function": "apply_checks_x509"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "41390464628760100341107141452971513954",
                "7950253584050282768922219233417925903",
                "158507195847219263287957780964758464225",
                "56945746907057072121839282470684718614",
                "314664826875976286879378461367088576356",
                "5212229767488633771297853605818248598",
                "157161959982558730721183189922431135339",
                "164847143972191741969536452103417916518",
                "256128052219123974491449541871341606525",
                "278833383657719825240471399499253073062",
                "62124606037992031958921748970960097470",
                "336638997457727185517646444663237757995",
                "157152400354143002573461155961355216076",
                "318667161459102597720317365144020644937",
                "115354673208741260461794726762073550649",
                "110239215636413111423938405307988413763",
                "295954278425109614443873228265305093379",
                "171208036860798797389256436115524226736",
                "223997604530774247919198698290159666909",
                "173411794584533965074647056298447307145",
                "270707444112632106518730320504008058743",
                "54389441463944043775356954201478747105",
                "113392725807664565037008853672634547040",
                "144675937310752386933589505616561257827",
                "122323865714021380637328077752480173270",
                "244882001775033052548694384045120472888",
                "62735860919960634384691505220477580996",
                "42498698442976845495304562358023705737",
                "90803122881316532792193648194404171334",
                "234738117507186037494576667036186318969",
                "319793919464926764970300914226690062092",
                "282040879745836692616432842220337143451",
                "40858280259864701044817126107179700309",
                "37621381570263226918162799025515870706",
                "293547753836265827221416658597448926750",
                "98536053102677698758916359540500492986",
                "1531767682280983180159382563182577620",
                "145043820055235100733785029795806308253",
                "321148129163127585614204230007218356615",
                "262330813388572138656192330039632131936",
                "48617231570007855977419539835274258483",
                "105309717863833735243437528847734337726",
                "274613338622570422919006268089013149558",
                "46654585698274519125932740525761765750",
                "109337282911759660680776091473733601304",
                "90771882862760395054116691264895104324",
                "277159470915046850929578242684744220003",
                "9371623567045340654589284556469588438",
                "178577773159993310457797394225687898044",
                "81609822194872510490028844532273249054",
                "17574708763274639951650550865644637834",
                "199643968799862425982354732501769898200",
                "141795292722165427403103992171836349114",
                "72906254534377753669515950110474423034",
                "131411534032262316304039309063379751023",
                "290142473679211847343743219624438265971",
                "159274998417847028036088056968611977941",
                "61140470853341590060115274819980182",
                "31548763571945538657504600079238329916",
                "300098289138348851102815899880750199341",
                "80045182358985459768912981096416501913",
                "102331681077463331774880498581966166175",
                "81335255796682370210058997304506705416",
                "315266671122743939986337607611235454570",
                "206232198835847013795628696708327691532",
                "97425830726469631551503436352714363042",
                "82057778215592316538282948899315807679",
                "301994027249665815250883040850956648031",
                "19117505814673933864311337052863848764",
                "152136204887616063349027616812208858664",
                "107087259292962345196927823947450630614",
                "247991070303591275770130680611409841381",
                "26081045986655976541057551240855698727",
                "60198707246532660128208247713582354682",
                "49631987794744934519907231427109127196",
                "218894036245660998743727876805864475604",
                "140858845785390437058636457340895332115",
                "323320182024821254261106099587353994358",
                "112495483062930969852045669778004888674",
                "134297616988317296674089172298721906577",
                "11121415330460962031499587576035902084",
                "51279639487108420957988452995192189908",
                "317000237827092356655148867783748968720",
                "264032197742673673920953546995287253591",
                "57336075568188055860409134558958891060",
                "140996945855944951154769590502994032818",
                "204681096308582539219982520415929457426",
                "281668846445810764676050387014416139159",
                "249394622604781409386309012558808187775",
                "149509365850086105136986779202065440834",
                "173042794270245385792149154726560869992",
                "286449400268884072366846288133353980956",
                "234859019811100577526789965787543159436",
                "244811254008930712341020733559278063696",
                "245251096476544404823004770944528430610",
                "38425968662703274657653911055086117688",
                "302759434847721811046663916132864083416",
                "20693636247766921957360776864757620021",
                "47490681850235819757690912428463221052",
                "45541118769065665233896400351112526120",
                "296490982922696458727406230738076892080",
                "196840532734088952207040913184047078165",
                "295198607537664681656702936859165318131",
                "110545341721218386610186737905658659415",
                "45167867538030859089388350253544213565",
                "65291556104379090850107049515513623069",
                "141814634525562252271359138188371025534",
                "249701113304331777972770165996333176265",
                "259797787919154272172704466098242198450",
                "261363314284341513672873066753546820746",
                "279225447773646349180708162829790413660",
                "69729033611509601786637285967552967759",
                "336862176912370893275982898959310414052",
                "42366356876349167626340950562930548420",
                "298497982055856068884625450505733856217",
                "234412084946879470717616911472388448476",
                "28784174220091148327857970275977799422",
                "287463084618636923793069608884982630441",
                "57932291644271902850819191062648155552",
                "193775896897123523683864979003755731602",
                "313931563347384397002728802180420988197",
                "336857148894249902208887266661994593737",
                "258442028774706285083940436794709783690",
                "284859160837565504370503693652894861065",
                "254848921524817648562536611015788251246",
                "229069201701531812231929371336994719045",
                "86652963682598578143902622279827644215",
                "38248625500375343870250243585423387963",
                "127755525278393320782181185102679292379",
                "63424254011248425366342782471758764225",
                "286561738893208013500352337793861896983",
                "266877259546523059842000496231152088769",
                "144418997830935445743521926579442888121",
                "338162540374349619050001652425166482999",
                "125062847412517968840556995015554490879",
                "21432341732703084744323300308190892818",
                "322377541217224676558029577338079417582",
                "241035193359888855547782125391516599608",
                "78929668702032854802480111848891897193",
                "226502281223127512183014414109962841312",
                "283275146197721326713187081453853015001",
                "128796242475980841399188253636133031651",
                "238691230039107122746522561150526799589",
                "29183612149220598372093659531440659535",
                "232352465913379057230520379814617694554",
                "14011209148373848581909143961970900452",
                "64262405332341014275443605153523627670",
                "57133167780645080923475001415268751816",
                "74222337000454195120702301624710621425",
                "145253316783028826049633589737592742002",
                "157825081992168997836541018932890201887",
                "121358128938554981439542631155455452708",
                "38822578661144102357731004521609608497",
                "85813202150614609876694498037994398966",
                "89417920253924736140027573460463227792"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-34610-791eb92d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/smuellerdd/leancrypto/commit/5cdcbe12bd6c3d6e87e969972a580b44a74c3a6a",
        "target": {
            "file": "asn1/src/x509_cert_parser.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "117953443678596816205776449830682423899",
            "length": 292
        },
        "id": "CVE-2026-34610-8e997192",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/smuellerdd/leancrypto/commit/5cdcbe12bd6c3d6e87e969972a580b44a74c3a6a",
        "target": {
            "file": "asn1/src/x509_cert_parser.c",
            "function": "lc_x509_note_subject"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "43146238336459893764294440905717897568",
            "length": 331
        },
        "id": "CVE-2026-34610-a1b7b059",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/smuellerdd/leancrypto/commit/5cdcbe12bd6c3d6e87e969972a580b44a74c3a6a",
        "target": {
            "file": "asn1/src/x509_cert_parser.c",
            "function": "lc_x509_san_dns"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "335026396261045871311658385611038821680",
            "length": 4789
        },
        "id": "CVE-2026-34610-a40261cf",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/smuellerdd/leancrypto/commit/5cdcbe12bd6c3d6e87e969972a580b44a74c3a6a",
        "target": {
            "file": "apps/src/lc_x509_generator_checker.c",
            "function": "apply_checks_pkcs7"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "87642604503351019041721202532522770774",
                "207721165806019042845559080551048129849",
                "16048325811504643466726575643970942081",
                "146972555278803247851304691885232867850",
                "56216282427421605417009281381724891819",
                "93968143087714776405321304616759584005",
                "60914850805924094528324492728615117435",
                "45995190564450446986793879804431874226",
                "3226515372416973167522841847802789549",
                "231968272525717089868913525326370221640"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-34610-e880e4d9",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/smuellerdd/leancrypto/commit/5cdcbe12bd6c3d6e87e969972a580b44a74c3a6a",
        "target": {
            "file": "asn1/api/lc_x509_common.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "174280691164350142625763420265057904656",
            "length": 1400
        },
        "id": "CVE-2026-34610-f7375d45",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/smuellerdd/leancrypto/commit/5cdcbe12bd6c3d6e87e969972a580b44a74c3a6a",
        "target": {
            "file": "asn1/src/x509_cert_parser.c",
            "function": "lc_x509_extract_name_segment"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "77306670239817545821864615052797384792",
                "148806343282618891315833419146342813513",
                "25493044197356541223420684563001168412",
                "112550917920269754574600652375908790688",
                "16898899656693944688632584133423110456",
                "272644214607569901014300411409282299705",
                "114124584023087457976431378716651386306",
                "324691592541705963607708085392541578522",
                "295832616913953295151284179544183984070",
                "217643749396607555117920018775698276473",
                "19368314823249115785472509664007622325",
                "161856339425022331253303397874646786268"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-34610-fb002119",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/smuellerdd/leancrypto/commit/5cdcbe12bd6c3d6e87e969972a580b44a74c3a6a",
        "target": {
            "file": "asn1/src/x509_cert_parser.h"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T15:33:38Z"