CVE-2026-34181 PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys
Attackers can forge PKCS#12 certificates and private keys by exploiting insufficient HMAC key validation, potentially leading to impersonation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34181?
CVE-2026-34181 is a high-severity vulnerability in Openssl Openssl, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery.
Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability.
If a service accepting PKCS#12 files is using passwords for authenticating the received files, the attacker can create unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte, allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the service to accept a certificate and private key controlled by the attacker.
The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
Weakness: CWE-354
Which versions are affected by CVE-2026-34181?
It affects 1 product.
Products include Openssl Openssl.
How do I fix CVE-2026-34181?
Apply the vendor's patch.
Is CVE-2026-34181 being exploited?
There is no known exploitation of CVE-2026-34181 in the wild and no public exploit code.
Other vulnerabilities in Openssl Openssl
Sources
Also known as ALPINE-CVE-2026-34181, BELL-CVE-2026-34181, DEBIAN-CVE-2026-34181, GHSA-4jgc-cj59-f9mm, JLSEC-2026-1134, MINI-647h-5wjm-hwvm and 1 more.