{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"ssldump","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NQ3V62VSBYBYP7VDRJRR81","modified_at":"2026-10-23T17:47:30.414217947Z","published_at":"2026-10-16T06:17:09.510Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-111458","https://security-tracker.debian.org/tracker/CVE-2026-111458"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-111458","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-111458"}],"summary":"The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) +"}