Moderate Vulnerability in OpenCryptoki: Information Disclosure and Denial of Service
Summary
RLSA-2026:28231: Moderate: opencryptoki security update. Affects opencryptoki versions < 0:3.26.0-3.el10_2.1. Fixed in 0:3.26.0-3.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenCryptoki is a software implementation of the PKCS#11 API, primarily designed for IBM Cryptocards, including models like IBM 4764 and 4765. It supports various IBM cryptographic hardware and provides a software token implementation for environments without hardware. The package includes essential components such as the Slot Daemon (pkcsslotd) and utilities for managing cryptographic operations. However, it is susceptible to vulnerabilities that can lead to security breaches.
Vulnerability Detail
The vulnerability identified as CVE-2026-40253 allows for information disclosure and denial of service through malformed BER-encoded cryptographic objects. This issue arises from improper handling of certain input data, which could lead to unauthorized access to sensitive information or cause the service to become unavailable. The potential impact includes disruption of cryptographic operations and exposure of confidential data.
How To Fix
Minimum fixed version
0:3.26.0-3.el10_2.1
This is the first release that contains the fix.
sudo dnf update opencryptokiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workaround is provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The OpenCryptoki package has a moderate vulnerability (CVE-2026-40253) that can lead to information disclosure and denial of service. It is crucial to update to the patched version to safeguard against potential threats. Regular monitoring and updates are essential for maintaining security in software applications.
See every vulnerability recorded for opencryptoki →
FAQ
CVE-2026-40253 is a vulnerability in OpenCryptoki that allows for information disclosure and denial of service due to malformed input data.
The vulnerability can lead to unauthorized access to sensitive information and service disruptions, affecting cryptographic operations.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.8, indicating a moderate level of severity.
You can update the OpenCryptoki package by running 'sudo yum update opencryptoki' in your terminal, ensuring you have access to the BaseOS repository.
Related vulnerabilities
Recent vulnerabilities recorded for opencryptoki.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
