openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer length parameter, and trust attacker-controlled BER length fields without validating them against actual buffer boundaries. All primitive decoders are affected: ber_decode_INTEGER, ber_decode_SEQUENCE, ber_decode_OCTET_STRING, ber_decode_BIT_STRING, and ber_decode_CHOICE. Additionally, ber_decode_INTEGER can produce integer underflows when the encoded length is zero. An attacker supplying a malformed BER-encoded cryptographic object through PKCS#11 operations such as C_CreateObject or C_UnwrapKey, token loading from disk, or remote backend communication can trigger out-of-bounds reads. This affects all token backends (Soft, ICA, CCA, TPM, EP11, ICSF) since the vulnerable code is in the shared common library. A patch is available thorugh commit ed378f463ef73364c89feb0fc923f4dc867332a3.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-797:04 advisory.

    * openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded     cryptographic objects (CVE-2026-40253)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26352 advisory.

    * openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded     cryptographic objects (CVE-2026-40253)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-26352 advisory.

    [3.22.0-3.3]
    - Resolves: RHEL-171558, Fix possible out-of-bounds access in BER decode functions

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26352 advisory.

    The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such     as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic     CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM     eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for     Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token     implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon     (pkcsslotd) and general utilities.

    Security Fix(es):

    * openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded     cryptographic objects (CVE-2026-40253)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0401 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-40253:
    openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below,     the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer     length parameter, and trust attacker-controlled BER length fields without validating them against actual     buffer boundaries. All primitive decoders are affected: ber_decode_INTEGER, ber_decode_SEQUENCE,     ber_decode_OCTET_STRING, ber_decode_BIT_STRING, and ber_decode_CHOICE. Additionally, ber_decode_INTEGER     can produce integer underflows when the encoded length is zero. An attacker supplying a malformed BER-     encoded cryptographic object through PKCS#11 operations such as C_CreateObject or C_UnwrapKey, token     loading from disk, or remote backend communication can trigger out-of-bounds reads. This affects all token     backends (Soft, ICA, CCA, TPM, EP11, ICSF) since the vulnerable code is in the shared common library. A     patch is available thorugh commit ed378f463ef73364c89feb0fc923f4dc867332a3.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20699-1 advisory.

    This update for openCryptoki fixes the following issues

    Security issue:

    - CVE-2026-40253: Updated fix for malformed BER-encoded cryptographic objects       (bsc#1262283).

    Non security issue:

    - Refactored .spec file to fully support transactional and immutable operating systems      (jsc#PED-14609):
     * Migrated user and group creation (pkcs11, pkcsslotd) from imperative %pre shell commands to      declarative systemd-sysusers configuration.
     * Replaced manual /var directory tracking and %ghost directives with      comprehensive systemd-tmpfiles configurations.
     * Implemented dynamic, architecture-specific tmpfiles.d generation to properly provision      hardware-specific token directories (e.g., ccatok, ep11tok, lite, and HSM_MK_CHANGE).
    - Fixed permissions for /run/opencryptoki within tmpfiles.d to ensure the      daemon can successfully drop privileges and bind its communication socket.
     * Moved 32-bit and 64-bit shared library symlink creation (such as PKCS11_API.so, stdll, and methods)      from %post scriptlets into the %install phase,      ensuring they are correctly packaged and tracked on the read-only /usr partition.
     * Removed legacy /etc/pkcs11 bash migration logic from %post,      replacing it with a declarative tmpfiles.d symlink rule.
    - Cleaned up scriptlets to only execute transaction-safe macros      (such as ldconfig and systemd service handlers).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below,     the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer     length parameter, and trust attacker-controlled BER length fields without validating them against actual     buffer boundaries. All primitive decoders are affected: ber_decode_INTEGER, ber_decode_SEQUENCE,     ber_decode_OCTET_STRING, ber_decode_BIT_STRING, and ber_decode_CHOICE. Additionally, ber_decode_INTEGER     can produce integer underflows when the encoded length is zero. An attacker supplying a malformed BER-     encoded cryptographic object through PKCS#11 operations such as C_CreateObject or C_UnwrapKey, token     loading from disk, or remote backend communication can trigger out-of-bounds reads. This affects all token     backends (Soft, ICA, CCA, TPM, EP11, ICSF) since the vulnerable code is in the shared common library. A     patch is available thorugh commit ed378f463ef73364c89feb0fc923f4dc867332a3. (CVE-2026-40253)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321648	MiracleLinux 8 : opencryptoki-3.22.0-3.el8_10.3 (AXSA:2026-797:04)	Nessus	Miracle Linux Local Security Checks	medium
321340	RockyLinux 8 : opencryptoki (RLSA-2026:26352)	Nessus	Rocky Linux Local Security Checks	medium
321315	Oracle Linux 8 : opencryptoki (ELSA-2026-26352)	Nessus	Oracle Linux Local Security Checks	medium
321224	RHEL 8 : opencryptoki (RHSA-2026:26352)	Nessus	Red Hat Local Security Checks	medium
319762	TencentOS Server 4: opencryptoki (TSSA-2026:0401)	Nessus	Tencent Local Security Checks	medium
313703	openSUSE 16 Security Update : openCryptoki (openSUSE-SU-2026:20699-1)	Nessus	SuSE Local Security Checks	medium
307346	Linux Distros Unpatched Vulnerability : CVE-2026-40253	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-40253

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium