CVE-2026-43823

When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1.

• CWE-415

• https://github.com/apple/swift-crypto/security/advisories/GHSA-8q93-f6xh-4f6fVendor Advisory
• https://github.com/apple/swift-crypto/security/advisories/GHSA-8q93-f6xh-4f6fVendor Advisory

Published

Jul 23, 2026

Last Modified

Sep 4, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43817An out-of-bounds read was addressed with improved bounds che…5.5
• CVE-2026-43818An integer overflow was addressed with improved input valida…8.8
• CVE-2026-43819An access issue was addressed with additional sandbox restri…5.5
• CVE-2026-43820NIOSSLCertificate._subjectAlternativeNames provides access t…7.7
• CVE-2026-43821An access issue was addressed with improved access restricti…6.5
• CVE-2026-43822A use after free issue was addressed with improved memory ma…9.8
• CVE-2026-43824In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, Serve…7.7
• CVE-2026-43825Untrusted Java Deserialization in Apache OpenNLP SvmDoccatMo…7.3
• CVE-2026-43826The OpenSearch logging provider, when configured with a `hos…6.5
• CVE-2026-43827Default configurations of Apache Shiro have a session fixati…6.5
• CVE-2026-43828Default configurations of Apache Shiro send sensitive cookie…6.5
• CVE-2026-43829Full details and mitigation steps are currently restricted a…7.5