---
schema_version: '1.0'
id: security-20260705-80643a
url: https://osv.dev/vulnerability/DEBIAN-CVE-2026-31789
url_hash: 80643a91b8def06c8eeefb1afb889f1c54ea8eb8e76cc34d975dd3cabc6bb880
canonical_url: https://osv.dev/vulnerability/DEBIAN-CVE-2026-31789
source: osv:debian
category: security/os
category_raw: cve/os
region: null
tags:
- cve
- DEBIAN-CVE-2026-31789
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- openssl
- Debian
lang: en
published_at: '2026-04-07T22:16:21Z'
fetched_at: '2026-07-05T15:34:34Z'
updated_at: '2026-07-05T15:36:29Z'
status: published
content_hash: 66428300030fc3a81d9fda6770811fc965ad77bc36bf4ff846b8d156506ef1c5
license_note: full
summary: 'Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal
  string leads to a heap buffer overflow on 32 bit platforms.  Impact summary: A heap
  buffer overflow may lead to a crash or possibly an attacker controlled code execution
  or other undefined behavior'
summary_source: rss
summary_en: 'Issue summary: Converting an excessively large OCTET STRING value to
  a hexadecimal string leads to a heap buffer overflow on 32 bit platforms.  Impact
  summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled
  code execution or other undefined behavior'
entities: []
key_facts: []
related: []
related_auto: []
title: DEBIAN-CVE-2026-31789 — openssl
---

# DEBIAN-CVE-2026-31789 — openssl

## TL;DR
Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms.  Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior

## Key Points
- cve / DEBIAN-CVE-2026-31789 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H / openssl / Debian

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
**Advisory:** DEBIAN-CVE-2026-31789

**Affected (your watchlist):**
- `Debian:openssl` 3.0.11-1~deb12u2 → no fixed version listed [rpi]

**Details:**
Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms.  Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior.  If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the size of the buffer needed for the result is calculated as multiplication of the input length by 3. On 32 bit platforms, this multiplication may overflow resulting in the allocation of a smaller buffer and a heap buffer overflow.  Applications and services that print or log contents of untrusted X.509 certificates are vulnerable to this issue. As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity.  The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

**References:**
- https://security-tracker.debian.org/tracker/CVE-2026-31789

_Data: OSV.dev (upstream: debian) — https://osv.dev/vulnerability/DEBIAN-CVE-2026-31789_

## Source
元記事: [DEBIAN-CVE-2026-31789 — openssl](https://osv.dev/vulnerability/DEBIAN-CVE-2026-31789) — published 2026-04-07T22:16:21Z