Skip to content
OpenAdvisories

Product · h2o

picotls

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-59993

    Picotls has NULL pointer dereference during handshake, when running as a client

    Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a `client-side TLS stack`, a peer can send a `HelloRetryRequest` followed by a `spoofe…

    h2o picotls
  • Medium 5.5
    CVE-2026-45271

    picotls has infinite recursion in the minicrypto ASN.1 decoder

    Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS#8 private keys. Prior to commit …

    h2o picotls