JLSEC-2026-234

See a problem?
Please try reporting it to the source first.
Source
https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-234.md
Import Source
https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-234.json
JSON Data
https://api.osv.dev/v1/vulns/JLSEC-2026-234
Upstream
  • EUVD-2023-0817
Published
2026-04-27T18:33:55.942Z
Modified
2026-07-25T18:23:49.525206779Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
Summary
Vulnerable OpenSSL included in cryptography wheels
Details

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING.

When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Database specific 
{
    "sources": [
        {
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0286",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-0286",
            "modified": "2026-06-17T05:25:12.637Z",
            "id": "CVE-2023-0286",
            "published": "2023-02-08T20:15:24.267Z",
            "imported": "2026-07-17T21:25:49.288Z",
            "database_specific": {
                "status": "Modified"
            }
        },
        {
            "html_url": "https://github.com/advisories/GHSA-x4qr-2fvf-3mr5",
            "modified": "2025-11-04T22:08:45Z",
            "id": "GHSA-x4qr-2fvf-3mr5",
            "published": "2023-02-08T22:17:06Z",
            "imported": "2026-07-17T21:25:49.457Z",
            "url": "https://api.github.com/advisories/GHSA-x4qr-2fvf-3mr5"
        },
        {
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-0817",
            "modified": "2025-11-04T19:14:36Z",
            "id": "EUVD-2023-0817",
            "published": "2023-02-08T19:01:50Z",
            "imported": "2026-07-17T21:25:59.965Z",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2023-0817"
        }
    ],
    "license": "CC-BY-4.0"
}
References
Credits

Affected packages

Julia / OpenSSL_jll

Package

Name
OpenSSL_jll
Purl
pkg:julia/OpenSSL_jll?uuid=458c3c95-2e84-50aa-8efc-19380b2a3a95

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.20+0

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-234.json"

Julia / Openresty_jll

Package

Name
Openresty_jll
Purl
pkg:julia/Openresty_jll?uuid=87da34d4-7b1b-5a94-8376-8cb65bf3132c

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.27.1+0

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-234.json"