← Back to Templates
TEMPLATE #2 • SECURITY ADVISORY / CVE
LUAR-2026-0819
•
CVE-2026-38491
CRITICAL • CVSS 9.8
Remote Code Execution via Malformed ASN.1 Header in Legacy Edge Proxies
Vulnerability Threat Summary
A heap-buffer overflow condition was uncovered during Luar Threat Lab fuzzing of ASN.1 parser routines in legacy TLS terminators. An unauthenticated remote attacker can dispatch crafted ClientHello extensions triggering unconstrained instruction pointer hijacking.
Indicators of Compromise (IoCs)
SHA256: 4a2d8e3b1f9c0e5a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a
IP Block (C2 Source): 194.26.29.0/24 (Malicious scanner burst from unverified BGP AS)
Sigma SOC Detection Rule
title: ASN.1 Parser Malformed Extension Exploitation Attempt
id: c6f8a920-5d41-49b2-a42e-89a1c24f3310
status: production
description: Detects out-of-bounds ASN.1 certificate payload lengths targeted at edge proxy nodes
author: Luar Threat Research Lab (Dublin, IE)
logsource:
category: webserver_tls
product: edge_proxy
detection:
selection:
c-tls-ext-len|gt: 8192
c-tls-asn1-depth|gt: 8
condition: selection
fields:
- c-ip
- c-tls-sni
- c-tls-cipher
level: critical
Remediation & Action Checklist
- Upgrade Dublin edge proxy binaries to version 4.19.2-luar-p3 immediately.
- Enable L7 WAF rule set
LUAR-WAF-RULE-4491on perimeter ingress nodes. - Audit memory core dump traces for any unexpected child worker crashes.