CVE-2026-102268: Pem Detector Regex Requires Newline Key Confusion

PEM/asymmetric-key material is recognized with a regex that mandates an escape-encoded line break (\r or \n) between the -----BEGIN and -----END markers. PEM parsers (e.g. the pyca/cryptography PEM loader) accept representations without LF-terminated marker lines (CR-only line endings, whitespace before '-----END', folded single-line form), so this recognize

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0Python
greprules fetch cve-2026-102268-pem-detector-regex-requires-newline-key-confusion --engine opengrep

Description

PEM/asymmetric-key material is recognized with a regex that mandates an escape-encoded line break (\r or \n) between the -----BEGIN and -----END markers. PEM parsers (e.g. the pyca/cryptography PEM loader) accept representations without LF-terminated marker lines (CR-only line endings, whitespace before '-----END', folded single-line form), so this recognize