PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9939 Cryptopp CVE debrief

CVE-2016-9939 affects Crypto++ (aka cryptopp and libcrypto++) 5.6.4 in its ASN.1 BER decoding path. When the decoder allocates memory from the ASN.1 length field and then discovers there are not enough content octets, it fails and zeroes the allocated block even if it is otherwise unused. For large allocations, that wipe introduces a noticeable delay, which can translate into a high-impact availability problem. NVD rates the issue as network-reachable with no privileges or user interaction required, and assigns a HIGH severity score (CVSS 7.5). The primary weakness classification is CWE-20 (improper input validation).

Vendor
Cryptopp
Product
CVE-2016-9939
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-30
Original CVE updated
2026-05-13
Advisory published
2017-01-30
Advisory updated
2026-05-13

Who should care

Teams running applications or libraries that use Crypto++/libcrypto++ 5.6.4 to parse ASN.1 BER data, especially when inputs may be attacker-controlled or remotely supplied.

Technical summary

According to the NVD record, Crypto++ 5.6.4’s ASN.1 BER decoder allocates based on the ASN.1 length field. If the object does not contain enough content octets, the function fails and wipes the allocated memory block even when the block is not otherwise used. That zeroing step can take a noticeable amount of time for large allocations. NVD classifies the issue as CWE-20 and scores it CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Defensive priority

High — prioritize remediation if the library is used to parse untrusted ASN.1 BER input.

Recommended defensive actions

  • Identify where Crypto++/libcrypto++ 5.6.4 is deployed in your environment.
  • Check whether the affected code paths parse ASN.1 BER from external or attacker-controlled sources.
  • Apply the vendor or distribution fix referenced in the linked advisories and patch discussion.
  • Upgrade to a corrected Crypto++ release if you are still on 5.6.4.
  • Add input validation and size limits around ASN.1 parsing to reduce exposure to malformed or oversized inputs.
  • Watch for unusual latency, CPU spikes, or request slowdowns during ASN.1 processing.

Evidence notes

This debrief is based on the supplied NVD CVE record and its linked references. The NVD entry describes the ASN.1 BER decoding allocation-and-wipe behavior, lists CWE-20, and assigns CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The reference set also includes a Debian security advisory, an oss-security patch thread, a SecurityFocus VDB entry, and a Fedora package announcement, which corroborate that fixes were being discussed and distributed around the time of the vulnerability disclosure.

Official resources

CVE-2016-9939 was published on 2017-01-30. The supplied reference set includes related advisories and patch discussion dated 2016-12-12, and the NVD record was last modified on 2026-05-13.