CVE-2012-2686: crypto/evp/e_aes_cbc_hmac_sha1.c in the AES-NI functionality in the TLS 1.1 and 1.2 implementations in Open...

Security readout for executives and security teams

This is an OpenSSL TLS denial-of-service flaw. A remote attacker could send specially crafted CBC data to crash an application using vulnerable OpenSSL AES-NI code. The supplied sources identify OpenSSL 1.0.1 before 1.0.1d; they do not show code execution or confirmed active exploitation. Exposure is most likely on legacy systems running OpenSSL 1.0.1 before 1.0.1d with AES-NI enabled and TLS 1.1 or 1.2 CBC cipher use. Products bundling affected OpenSSL may also be exposed, but the bundle does not provide a complete product inventory. Treat this as a legacy exposure cleanup item with operational impact. It is not sourced as active exploitation or code execution, but internet-facing TLS services using the affected OpenSSL branch should be prioritized for patch confirmation. Mitigation focus: Upgrade affected OpenSSL 1.0.1 deployments to 1.0.1d or later vendor-supported builds.; Apply operating system or appliance vendor updates that include the OpenSSL fix.; Inventory products that bundle OpenSSL and confirm vendor advisory coverage..

Prepared

Jun 15, 2026, 04:24 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.