Moderate Vulnerability in OpenCryptoki: Information Disclosure and Denial of Service Risk
Summary
ALSA-2026:28231: Moderate: opencryptoki security update. Affects opencryptoki versions < 3.26.0-3.el10_2.1. Fixed in 3.26.0-3.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCryptoki is a set of packages that implement the PKCS#11 API for IBM Cryptocards, including models like IBM 4764 and 4765. It supports various cryptographic hardware and provides a software token implementation for cryptographic operations without hardware. The packages include essential components like the Slot Daemon (pkcsslotd) and utilities for managing cryptographic tokens. However, a vulnerability has been identified that could compromise the security of these implementations.
Vulnerability Detail
The vulnerability, identified as CVE-2026-40253, arises from the handling of malformed BER-encoded cryptographic objects within the OpenCryptoki packages. This flaw can lead to information disclosure and potential Denial of Service (DoS) attacks, allowing unauthorized access to sensitive information and disrupting service availability. The issue is particularly concerning as it affects multiple components of the OpenCryptoki suite, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
3.26.0-3.el10_2.1
This is the first release that contains the fix.
sudo dnf update opencryptokiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the OpenCryptoki services or implement network-level controls to mitigate exposure to potential attacks until the packages are updated.
Conclusion
The OpenCryptoki vulnerability CVE-2026-40253 poses significant risks, including information disclosure and Denial of Service. Users should prioritize updating their packages to the latest patched version to mitigate these risks effectively. Utilizing tools like Vulert can help monitor and manage vulnerabilities in real-time.
See every vulnerability recorded for opencryptoki →
FAQ
CVE-2026-40253 is a vulnerability in OpenCryptoki that allows for information disclosure and Denial of Service due to improper handling of malformed cryptographic objects.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to receive real-time alerts.
The vulnerability can lead to unauthorized access to sensitive information and service disruptions, which can affect the overall security and reliability of applications using OpenCryptoki.
Yes, a patch is available in version 3.26.0-3.el10_2.1 of the OpenCryptoki packages. Users are advised to update to this version or later.
If immediate updates are not possible, consider implementing network-level controls to restrict access to OpenCryptoki services as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for opencryptoki.
