The core issue in CVE-2026-45271 is a threat model mismatch: picotls' minicrypto backend was built with the assumption that untrusted input would flow through the OpenSSL/libcrypto path, while the lightweight fallback would handle keys from trusted sources. That assumption is now violated because the minicrypto path—precisely the one chosen for constrained environments—contains unbounded recursion in its custom ASN.1 DER validator. When ptls_minicrypto_load_private_key() parses attacker-supplied PKCS#8 DER, specially crafted constructed elements can exhaust the stack and crash the process.
This is not an isolated bug. The same pattern appeared in wolfSSL (CVE-2019-15666) and mbedTLS (CVE-2020-13230): a lightweight crypto backend with ASN.1 parsing, implicit trust assumptions, and unbounded recursion. The common thread is that 'constrained environment' became synonymous with 'no adversarial input'—a premise that fails the moment an embedded system loads a key from a config directory, firmware image, or bootstrap location that an attacker can influence.
The CVSS 5.5 score reflects a server crash, but in constrained deployments the impact is worse. A stack exhaustion on an embedded TLS sensor doesn't produce a clean error—it triggers watchdog reboots, hard-fault recovery states, or silent brick-and-recovery cycles. Critically, crash recovery in these environments typically does not zeroize key material resident in DRAM, creating a potential key-disclosure vector that the severity score doesn't capture.
The API design compounds the problem: ptls_minicrypto_load_private_key() and its libcrypto equivalent have identical signatures, masking the fact that switching backends changes your security contract. A developer choosing minicrypto for an embedded system assumes it's an implementation detail, not a decision that puts their key parsing on a path requiring explicit defensive coding against untrusted input.
If you're running picotls with minicrypto, verify that commit c14231d is applied and audit whether the fix uses bounded recursion, iteration, or a stack guard. If it's a depth counter, understand what threshold was chosen and whether crafted inputs near that limit can still degrade parsing on memory-constrained stacks. Consider whether your deployment model—loading keys from filesystem locations that may be attacker-controlled—matches the trust assumptions embedded in the minicrypto backend's original design.