Description

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS#8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c7, the validator recursively descends into constructed ASN.1 elements without enforcing a maximum nesting depth. If an application loads an attacker-supplied private-key file through ptls_minicrypto_load_private_key(), or otherwise calls the public ASN.1 validation API on untrusted DER, a crafted deeply nested ASN.1 structure can exhaust the process stack and crash the application. Note that the libcrypto (OpenSSL) backend does not use the ASN.1 validation helper of picotls, and therefore is immune to this vulnerability. The vulnerability has been addressed in commit c14231d801407640bc42c2dcf92783409ea6a7c7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-21T21:16:59.547Z",
  "pubdate": "2026-08-21T21:16:59.547Z",
  "executiveSummary": "Picotls contains a stack exhaustion vulnerability residing in its custom ASN.1 validation helper used by the minicrypto backend. The flaw stems from a lack of boundary enforcement on recursive descent when parsing constructed ASN.1 elements.\nAn attacker capable of supplying a malicious private-key file or otherwise passing crafted DER-encoded data to the public ASN.1 validation API can trigger uncontrolled recursion.\nThis behavior leads to stack exhaustion, resulting in an application crash and a subsequent denial of service.\nThe vulnerability affects applications utilizing the minicrypto backend to parse local PKCS#8 private keys via ptls_minicrypto_load_private_key() prior to commit c14231d801407640bc42c2dcf92783409ea6a7c7.\nThe libcrypto (OpenSSL) backend remains unaffected as it does not rely on the picotls ASN.1 validation helper.\nExploitation requires the application to process untrusted or attacker-controlled ASN.1 structures, such as a maliciously crafted private-key file.",
  "technicalDetails": "The vulnerability exists within the custom ASN.1 validation helper implemented by the picotls library, which is invoked by the minicrypto backend during the parsing of local PKCS#8 private keys.\nThe root cause of the flaw is the absence of a maximum nesting depth check during the recursive descent into constructed ASN.1 elements.\nWhen the public ASN.1 validation API processes a deeply nested, maliciously crafted DER structure, the parsing logic continuously invokes recursive function calls.\nEach recursive step consumes stack frame memory for local variables and function call overhead without imposing a limit to halt execution before exhausting available thread stack space.\nThe attack flow begins when an application calls ptls_minicrypto_load_private_key() or directly invokes the vulnerable public ASN.1 validation API with an attacker-supplied private-key file or untrusted DER payload.\nAs the parser traverses the deeply nested hierarchies of the crafted ASN.1 structure, the continuous allocation of stack frames breaches the process stack limits.\nThis unregulated recursion directly triggers a stack overflow exception, causing the host application process to crash and achieving a denial of service.\nThe vulnerability impacts software versions prior to commit c14231d801407640bc42c2dcf92783409ea6a7c7.\nAuthentication and privilege requirements depend on the application context, typically requiring the ability to supply or influence the private-key file loaded by the process.\nNetwork exposure is contingent on whether the application exposes functionality that ingests untrusted private keys or DER-encoded inputs over a network interface."
}