Skip to content
OpenAdvisories
Medium ELSA-2026-28256 1 CVE

Moderate: opencryptoki security update (Oracle Linux 9)

Published Jun 23, 2026 · Updated Jun 23, 2026

Ecosystem: Oracle Linux

Summary

[3.26.0-2.2]
- Resolves: RHEL-171562, Fix CVE-2026-40253, possible out-of-bounds access in BER decode functions

[3.26.0-2.1]
- Resolves: RHEL-169586, Fix syslog message printing about different CPs

Fixed packages 6

ReleasePackageFixed in
Oracle Linux · 9 opencryptoki 0:3.26.0-2.el9_8.2
Oracle Linux · 9 opencryptoki-ccatok 0:3.26.0-2.el9_8.2
Oracle Linux · 9 opencryptoki-devel 0:3.26.0-2.el9_8.2
Oracle Linux · 9 opencryptoki-icsftok 0:3.26.0-2.el9_8.2
Oracle Linux · 9 opencryptoki-libs 0:3.26.0-2.el9_8.2
Oracle Linux · 9 opencryptoki-swtok 0:3.26.0-2.el9_8.2

Vulnerabilities 1

  • Medium 6.8
    CVE-2026-40253

    openCryptoki: Memory safety vulnerabilities in BER/DER decoders in asn1.c

    openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer length parameter, and trust attacker-controlled BER…

    opencryptoki opencryptoki opencryptoki opencryptoki Debian Ubuntu Azure Linux