A few nights ago Thomas Ptacek shared a link to CVE-2026-34182 in OpenSSL with the note:one-byte tag vulnerability, everyone has to take a drink, that's the rule.The same bug turned out to be in wolfSSL (CVE-2026-5500), Bouncy Castle, and GnuPG's S/MIME tool gpgsm. Four independent crypto stacks all got it wrong in exactly the same place.The place is PKCS#7 / CMS parsing, and the bug is almost too dumb to believe. So let me use it as an excuse to talk about something I've been ranting about f...

Read the original article