CVE-2021-3712: Memory Disclosure in OpenSSL

CVE-2021-3712 identifies a buffer overrun in OpenSSL related to ASN1_STRING structures. ASN.1 printing functions assume that ASN1_STRING structures have a NUL-terminated 'data' field, but this is not guaranteed when applications construct them directly, bypassing OpenSSL's parsing functions. The violated assumption results in reading beyond allocated memory boundaries.

CVSS severity 7.4 (HIGH). The vulnerability was fixed on August 24, 2021 in OpenSSL 1.1.1l and 1.0.2za. Concrete risks are: application crash (Denial of Service) and disclosure of private memory (keys, sensitive data). A GitHub signal from November 6, 2026 reports activity related to vulnerability analysis on public repositories, indicating renewed interest from the research community, without representing a new discovery.

For defense: 1) Update OpenSSL immediately to version 1.1.1l or later (1.1.1 branch) or 1.0.2za or later (1.0.2 branch); 2) Verify whether your applications construct ASN1_STRING directly—if so, ensure the 'data' field is always NUL-terminated; 3) Monitor TLS/SSL service logs for crashes or anomalous behavior that might indicate exploitation attempts. Patches have been available for years.