CVE-2026-45271: Picotls ASN.1 Validation DOS Vulnerability

CVE-2026-45271 Overview

CVE-2026-45271 is a stack exhaustion vulnerability in Picotls, a TLS protocol library that supports pluggable crypto backends. The flaw resides in the library's ASN.1 validation helper used by the minicrypto backend when parsing local PKCS#8 private keys. The validator recursively descends into constructed ASN.1 elements without enforcing a maximum nesting depth. An attacker who supplies a crafted, deeply nested ASN.1 structure through ptls_minicrypto_load_private_key() or the public validation API can exhaust the process stack and crash the application. Applications using the libcrypto (OpenSSL) backend are not affected, because that backend does not use the picotls ASN.1 validation helper.

Critical Impact
A crafted DER-encoded private key file can crash any application that parses untrusted input through the picotls minicrypto ASN.1 validator, resulting in denial of service.

Affected Products

Picotls TLS library (minicrypto backend)
Applications calling ptls_minicrypto_load_private_key() on untrusted input
Applications invoking ptls_asn1_validation() on untrusted DER data

Discovery Timeline

2026-08-21 - CVE-2026-45271 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-45271

Vulnerability Analysis

The vulnerability is classified under [CWE-835] as a loop with unreachable exit condition, specifically manifesting as unbounded recursion. Picotls implements its own ASN.1 validation helper in lib/asn1.c to support the minicrypto backend. When the validator encounters a constructed ASN.1 element such as a SEQUENCE or SET, it calls itself recursively to parse the inner content. No depth counter or ceiling limits how far this descent can go.

DER encoding permits arbitrary nesting of constructed types. An attacker can produce a small file, on the order of a few dozen bytes, that describes hundreds of nested SEQUENCE structures. Each recursive call consumes a stack frame. Once the stack guard page is hit, the process receives a segmentation fault and terminates.

The impact is limited to availability. The bug does not corrupt heap memory or leak information. Exploitation requires local delivery of a malicious key file or DER blob, and requires the target application to load it.

Root Cause

The ASN.1 validator recurses into every constructed element without tracking the current depth or comparing it against an upper bound. The patch introduces the constant PTLS_ASN1_MAX_RECURSION set to 32 and enforces it during parsing.

Attack Vector

An attacker crafts a DER payload consisting of nested SEQUENCE tags. When an application passes this payload to ptls_minicrypto_load_private_key() or the public ptls_asn1_validation() API, the recursive validator descends until the stack is exhausted. The proof-of-concept added to the test suite demonstrates the technique.

static size_t build_nested_asn1_sequence(uint8_t *buf, size_t depth)
{
    size_t len = 3;

    buf[2 * depth] = 0x04;
    buf[2 * depth + 1] = 0x01;
    buf[2 * depth + 2] = 0x00;

    for (size_t i = depth; i != 0; --i) {
        size_t off = 2 * (i - 1);
        buf[off] = 0x30;
        buf[off + 1] = (uint8_t)len;
        len += 2;
    }

    return len;
}

static void test_asn1_recursion(void)
{
    uint8_t shallow[3 + 2 * 32];
    uint8_t too_deep[3 + 2 * 40];
    size_t len;

    len = build_nested_asn1_sequence(shallow, 32);
    ok(ptls_asn1_validation(shallow, len, NULL) == 0);
}

Source: GitHub Picotls Commit c14231d

Detection Methods for CVE-2026-45271

Indicators of Compromise

Unexpected crashes or segmentation faults in processes that link against picotls with the minicrypto backend enabled.
Core dumps showing deep recursive call stacks inside ptls_asn1_validation or related parsing routines.
Recent creation or delivery of PKCS#8 private key files from untrusted sources shortly before application termination.

Detection Strategies

Inventory binaries and services that statically or dynamically link picotls, and confirm whether they enable the minicrypto backend.
Review application logs and system journal entries for repeated abnormal terminations tied to key loading routines.
Enable core dump collection and inspect frames for recursion depth greater than 32 inside lib/asn1.c handlers.

Monitoring Recommendations

Alert on repeated crashes of TLS-enabled services that consume private key material at startup or reload.
Monitor file system paths that hold PKCS#8 keys for unexpected modification or replacement.
Track upstream picotls commits and downstream package updates that reference commit c14231d801407640bc42c2dcf92783409ea6a7c7.

How to Mitigate CVE-2026-45271

Immediate Actions Required

Update picotls to a revision that includes commit c14231d801407640bc42c2dcf92783409ea6a7c7 and rebuild dependent applications.
Restrict who can write to directories that hold private keys consumed by picotls-based services.
If patching is not immediately possible, switch affected applications to the libcrypto (OpenSSL) backend, which is not vulnerable.

Patch Information

The fix landed in commit c14231d801407640bc42c2dcf92783409ea6a7c7, which introduces PTLS_ASN1_MAX_RECURSION set to 32 and enforces the ceiling during ASN.1 validation. Additional details are available in the GitHub Security Advisory GHSA-84f5-m5x2-82q4 and the upstream commit.

Workarounds

Avoid passing untrusted DER data to ptls_asn1_validation() in applications that cannot be patched immediately.
Validate key file size and structure at the application layer before invoking ptls_minicrypto_load_private_key().
Configure the build to use the OpenSSL backend when the minicrypto ASN.1 helper is not required.

bash

# Rebuild picotls with the fix included
git clone https://github.com/h2o/picotls.git
cd picotls
git checkout c14231d801407640bc42c2dcf92783409ea6a7c7
git submodule update --init --recursive
cmake .
make