Moderate Vulnerability in Opencryptoki: Information Disclosure and Denial of Service
Summary
ALSA-2026:26352: Moderate: opencryptoki security update. Affects opencryptoki versions < 3.22.0-3.el8_10.3. Fixed in 3.22.0-3.el8_10.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Opencryptoki is a set of packages that implement the PKCS#11 API for IBM Cryptocards, including models like IBM 4764 and 4765. It supports various cryptographic hardware and provides a software token implementation for environments without hardware. The packages include essential components such as the Slot Daemon (pkcsslotd) and utilities for managing cryptographic operations.
Vulnerability Detail
The vulnerability identified as CVE-2026-40253 allows for information disclosure and denial of service through malformed BER-encoded cryptographic objects. This issue arises from improper handling of certain data formats, which can lead to unintended exposure of sensitive information or service interruptions, potentially impacting the integrity and availability of cryptographic operations.
How To Fix
Minimum fixed version
3.22.0-3.el8_10.3
This is the first release that contains the fix.
sudo dnf update opencryptokiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected services or limit the input to the cryptographic objects processed by the Opencryptoki packages until the update is applied.
Conclusion
The Opencryptoki vulnerability CVE-2026-40253 poses a moderate risk due to potential information disclosure and denial of service. It is crucial to update to the patched version to secure your systems and maintain the integrity of cryptographic operations.
See every vulnerability recorded for opencryptoki →
FAQ
CVE-2026-40253 is a vulnerability in Opencryptoki that can lead to information disclosure and denial of service due to malformed BER-encoded cryptographic objects.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can expose sensitive information and disrupt cryptographic services, affecting the security and availability of applications relying on Opencryptoki.
Yes, a patch is available. Update to version 3.22.0-3.el8_10.3 to mitigate the vulnerability.
If an immediate update is not possible, consider implementing access restrictions or input validation to mitigate the risk until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for opencryptoki.
