---
id: "CVE-2026-111458"
kind: "vulnerability"
aliases: ["CVE-2026-111458"]
title: "ssldump: heap overflow in FAN/1 fingerprinting lets crafted pcap run code"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["network-forensics", "package", "self-hosted", "ssldump"]
not_affected_if: ["default-config", "no-untrusted-pcap"]
published_at: "2026-10-16T06:17:09+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:45:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111458", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# ssldump: heap overflow in FAN/1 fingerprinting lets crafted pcap run code

ssldump's fanx_fingerprint function allocates a heap buffer 3 bytes too small for the FAN/1 X.509 fingerprint string, so sprintf overflows it on every call with valid input. An attacker who gets a user to open a crafted pcap file with FAN/1 fingerprinting enabled can crash ssldump or potentially execute code as that user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `ssldump -V` or `ssldump -h` to read the installed version and compare it with the fixed release listed by the vendor.
- Check whether scripts or aliases invoke `ssldump` with `-j -N` (FAN/1 fingerprinting).

## Fix

- Upgrade ssldump to a release that includes the fanx_fingerprint allocation fix (fixed version: unknown from the sources).
- Until patched, avoid running `ssldump -j -N` on untrusted pcap files.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111458

## From the sources

The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_