CVE Intelligence
Analysis AI-assisted

CVE-2021-3711: OpenSSL SM2 Decryption Buffer Overflow

CVE-2021-3711 is a buffer overflow in the SM2 decryption code of OpenSSL. The buffer size calculated during the first EVP_PKEY_decrypt() call can be smaller than the size needed by the second call, which may let attacker-chosen data overflow the buffer by up to 62 bytes. The NVD record gives it a CVSS 3.1 score of 9.8 (critical), and the fix is in OpenSSL 1.1.1l. The CVE is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2021-3711 affects the SM2 decryption path in OpenSSL. Applications normally call EVP_PKEY_decrypt() twice: once to learn the required output size and once to decrypt into an allocated buffer. A calculation bug can make the first size estimate smaller than what the second call needs, so the buffer can be too small. The record classifies the weakness as CWE-120 (Classic Buffer Overflow).

Impact

  • According to the record, data chosen by an attacker who can submit SM2 content for decryption can overflow the buffer by up to 62 bytes.
  • The overflow can alter other data stored after the buffer, which may change application behaviour or crash the application.
  • The NVD assessment gives CVSS 3.1 9.8 (critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and CVSS 2.0 7.5.
  • The SSVC data in the record rates technical impact as total and automatable as yes.

Affected products and versions

  • OpenSSL: the record states affected versions from 1.1.1 through 1.1.1k, with the fix in OpenSSL 1.1.1l.
  • The record also lists many downstream products from NetApp, Oracle, Tenable and Debian Linux. For many of them the source does not specify versions, so their exposure must be confirmed in each vendor advisory.
  • Vendor advisories linked in the record include NetApp NTAP-20210827-0010, Oracle CPU October 2021 and Debian DSA-4963.

Exploitation status

  • The CVE is not listed in CISA KEV in the record.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability in the record is about 0.878, which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

  • Upgrade OpenSSL to 1.1.1l or a later release that includes the fix.
  • For downstream products, apply the vendor patches and follow the advisories listed in the references, since fixed versions differ by product.
  • Until patching is complete, limit exposure of services that decrypt SM2 content from untrusted sources. This is an inference from the description and is not a vendor-stated workaround.

Detection guidance

  • Inventory systems that link OpenSSL 1.1.1 through 1.1.1k, including container images and bundled libraries.
  • Review application logs for crashes or memory faults in services that process SM2 decryption.
  • Monitor for unexpected application behaviour after SM2 decryption requests, without relying on any specific exploit signature.

Limitations of the available information

  • The record does not give exploit prerequisites specific to any application, so the practical reach of the overflow in real deployments is unknown.
  • Fixed versions for most listed downstream products are not stated in the record.
  • The buffer location depends on the application and is typically heap allocated, as stated in the description.

Frequently asked questions

Which OpenSSL versions are affected by CVE-2021-3711?

The record states that versions 1.1.1 through 1.1.1k are affected and that the fix is in OpenSSL 1.1.1l.

Is CVE-2021-3711 being exploited in the wild?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.