PT-2026-47830 · Openssl+4 · Openssl+4

Alex Gaynor + 2 · CVE-2026-34181 · Published 2026-06-09 · Updated 2026-06-26

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description PKCS#12 file processing fails to perform sufficient input validation for files using the Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism. This allows an attacker to create unencrypted PKCS#12 files that specify an HMAC key of only one byte. Consequently, a service reading these files may accept forged certificates and private keys with a 1 in 256 probability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-354

Related Identifiers

ALSA-2026:25237

ALSA-2026:25239

CVE-2026-34181

RHSA-2026:25237

RHSA-2026:25239

SUSE-SU-2026:2648-1

USN-8414-1

Affected Products

Freebsd

Linuxmint

Openssl

Rocky Linux

Ubuntu

References · 106

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34181.json · Exploit
• https://github.com/openssl/openssl/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f · Patch
• https://github.com/openssl/openssl/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7 · Patch
• https://github.com/openssl/openssl/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610 · Patch
• https://github.com/openssl/openssl/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81 · Patch
• ❌ https://github.com/openssl/security/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f · Patch, Deleted
• https://ubuntu.com/security/CVE-2026-45447 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-34181 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-34181 · Vendor Advisory
• ❌ https://github.com/openssl/security/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7 · Patch, Deleted
• ❌ https://github.com/openssl/security/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81 · Patch, Deleted
• https://ubuntu.com/security/CVE-2026-42769 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42770 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34181 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42764 · Vendor Advisory