CVE-2026-45271: H2O unbounded ASN.1 recursion

CISO Take

Picotls's minicrypto backend parses PKCS#8 private keys with a hand-rolled ASN.1 validator that recurses into nested structures without any depth limit, so a crafted deeply-nested DER file exhausts the process stack and crashes whatever loaded it. This only matters if your stack actually uses the minicrypto backend and lets an untrusted party supply a private-key file through ptls_minicrypto_load_private_key or the public ASN.1 validation API — the OpenSSL/libcrypto backend, which most production TLS stacks prefer, is immune, and there is no CISA KEV listing, no EPSS score, no public exploit, and no scanner template for this issue. Picotls sits underneath 27 downstream dependents, so blast radius is about exposure of that specific code path rather than widespread active exploitation. Treat this as a low-urgency patch-cycle item: update to commit c14231d801407640bc42c2dcf92783409ea6a7c7 or later, confirm which crypto backend your TLS-terminating components actually use, and never accept attacker-supplied private-key material without validating it comes from a trusted source first.

Sources:NVDGitHub AdvisoryOpenSSFATLAS

What is the risk?

CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects a local-vector, user-interaction-required denial-of-service with zero confidentiality or integrity impact — this is a crash bug, not a code-execution or data-exposure bug. Real-world exploitability is low: it requires an application built on picotls's minicrypto backend (not libcrypto/OpenSSL) to load a private-key file or DER blob supplied by an untrusted party, which is an uncommon architecture pattern outside of specific custom-cert-upload or multi-tenant TLS termination scenarios. No EPSS score, no KEV listing, no public PoC, and no Nuclei template exist, so there is no evidence of active or imminent exploitation. The package itself carries a mediocre OpenSSF Scorecard (5.5/10) and 17 other CVEs, suggesting general maintenance debt worth tracking even though this specific issue is narrow.

How does the attack unfold?

Malicious key delivery

Attacker supplies a crafted, deeply-nested ASN.1 PKCS#8 private-key file to an application feature that accepts user- or tenant-provided TLS keys.

Vulnerable parsing triggered

The application calls ptls_minicrypto_load_private_key(), invoking picotls's ASN.1 validator, which recurses into constructed elements with no depth limit.

Stack exhaustion

Unbounded recursion exhausts the process stack and crashes the TLS-handling process.

Service impact

The AI-enabled service behind that TLS process (e.g., an inference gateway) becomes unavailable until manually restarted.

AML.T0029

Malicious key delivery

Attacker supplies a crafted, deeply-nested ASN.1 PKCS#8 private-key file to an application feature that accepts user- or tenant-provided TLS keys.

Vulnerable parsing triggered

The application calls ptls_minicrypto_load_private_key(), invoking picotls's ASN.1 validator, which recurses into constructed elements with no depth limit.

Stack exhaustion

Unbounded recursion exhausts the process stack and crashes the TLS-handling process.

Service impact

The AI-enabled service behind that TLS process (e.g., an inference gateway) becomes unavailable until manually restarted.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
H2O	pip	—	No patch
7.5KOpenSSF 5.727 dependentsPushed 9d ago8% patched~0d to patchFull package profile →

Do you use H2O? You're affected.

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVLocal

ACLow

PRNone

UIRequired

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

Upgrade picotls to a version incorporating commit c14231d801407640bc42c2dcf92783409ea6a7c7 or later. If an immediate upgrade isn't possible, switch the TLS backend from minicrypto to libcrypto (OpenSSL), which does not use picotls's internal ASN.1 validator and is unaffected. Audit any feature that loads private keys from user- or tenant-supplied files and restrict it to trusted, pre-vetted key material only — never parse untrusted DER/PKCS#8 content with the public ASN.1 validation API. For detection, monitor TLS-terminating processes for unexpected crashes, stack-overflow signals (SIGSEGV near stack limits), or core dumps correlated with key-loading operations, and alert on repeated crash-restart cycles in edge/gateway services.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSAPIInferenceAML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

OWASP LLM Top 10

LLM04-Model Denial of Service

Frequently Asked Questions

What is CVE-2026-45271?

Picotls's minicrypto backend parses PKCS#8 private keys with a hand-rolled ASN.1 validator that recurses into nested structures without any depth limit, so a crafted deeply-nested DER file exhausts the process stack and crashes whatever loaded it. This only matters if your stack actually uses the minicrypto backend and lets an untrusted party supply a private-key file through ptls_minicrypto_load_private_key or the public ASN.1 validation API — the OpenSSL/libcrypto backend, which most production TLS stacks prefer, is immune, and there is no CISA KEV listing, no EPSS score, no public exploit, and no scanner template for this issue. Picotls sits underneath 27 downstream dependents, so blast radius is about exposure of that specific code path rather than widespread active exploitation. Treat this as a low-urgency patch-cycle item: update to commit c14231d801407640bc42c2dcf92783409ea6a7c7 or later, confirm which crypto backend your TLS-terminating components actually use, and never accept attacker-supplied private-key material without validating it comes from a trusted source first.

Is CVE-2026-45271 actively exploited?

No confirmed active exploitation of CVE-2026-45271 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-45271?

Upgrade picotls to a version incorporating commit c14231d801407640bc42c2dcf92783409ea6a7c7 or later. If an immediate upgrade isn't possible, switch the TLS backend from minicrypto to libcrypto (OpenSSL), which does not use picotls's internal ASN.1 validator and is unaffected. Audit any feature that loads private keys from user- or tenant-supplied files and restrict it to trusted, pre-vetted key material only — never parse untrusted DER/PKCS#8 content with the public ASN.1 validation API. For detection, monitor TLS-terminating processes for unexpected crashes, stack-overflow signals (SIGSEGV near stack limits), or core dumps correlated with key-loading operations, and alert on repeated crash-restart cycles in edge/gateway services.

What systems are affected by CVE-2026-45271?

This vulnerability affects the following AI/ML architecture patterns: model serving, API gateways.

What is the CVSS score for CVE-2026-45271?

CVE-2026-45271 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.15%.

What is the AI security impact?

Affected AI Architectures

model servingAPI gateways

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

Compliance Controls Affected

EU AI Act: Article 15

OWASP LLM Top 10: LLM04

What are the technical details?

Original Advisory

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS#8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c7, the validator recursively descends into constructed ASN.1 elements without enforcing a maximum nesting depth. If an application loads an attacker-supplied private-key file through ptls_minicrypto_load_private_key(), or otherwise calls the public ASN.1 validation API on untrusted DER, a crafted deeply nested ASN.1 structure can exhaust the process stack and crash the application. Note that the libcrypto (OpenSSL) backend does not use the ASN.1 validation helper of picotls, and therefore is immune to this vulnerability. The vulnerability has been addressed in commit c14231d801407640bc42c2dcf92783409ea6a7c7.

Exploitation Scenario

An organization runs an AI inference gateway built on h2o/picotls with the minicrypto backend and offers a self-service feature letting customers upload their own TLS certificate and private key for custom-domain routing. An attacker (a malicious or compromised tenant) uploads a PKCS#8 key file containing a deeply nested ASN.1 structure instead of a valid key. When the gateway calls ptls_minicrypto_load_private_key() to load it, the validator recurses thousands of levels deep, exhausts the stack, and crashes the TLS-handling process — taking down the inference endpoint for all tenants sharing that gateway until it is restarted, a low-effort denial-of-service against the AI service's availability.

Weaknesses (CWE)

CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')

CWE-835 — Loop with Unreachable Exit Condition ('Infinite Loop'): The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Source: MITRE CWE corpus.