Common Weakness Enumeration

CWE-295

Allowed

Improper Certificate Validation

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product does not validate, or incorrectly validates, a certificate.

2334 vulnerabilities reference this CWE, most recent first.

CVE-2026-63374 (GCVE-0-2026-63374)

Vulnerability from cvelistv5 – Published: 2026-09-22 15:23 – Updated: 2026-09-28 16:32
VLAI
Title
AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
Summary
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.
Severity
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 16:07 UTC
CWE
  • CWE-295 - Improper Certificate Validation
  • CWE-297 - Improper Validation of Certificate with Host Mismatch
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7639 records in the last 180 days details
References
Impacted products
Vendor Product Version
agronholm anyio Affected: < 4.14.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63374",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T16:07:36.655203Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T16:32:29.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "anyio",
          "vendor": "agronholm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.14.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint\u0027s certificate to validate. This issue is fixed in version 4.14.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-297",
              "description": "CWE-297: Improper Validation of Certificate with Host Mismatch",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T15:23:14.259Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6"
        },
        {
          "name": "https://github.com/agronholm/anyio/pull/1208",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/anyio/pull/1208"
        },
        {
          "name": "https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce"
        },
        {
          "name": "https://github.com/agronholm/anyio/releases/tag/4.14.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
        }
      ],
      "source": {
        "advisory": "GHSA-82r6-8w77-94w6",
        "discovery": "UNKNOWN"
      },
      "title": "AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63374",
    "datePublished": "2026-09-22T15:23:14.259Z",
    "dateReserved": "2026-07-16T17:39:30.170Z",
    "dateUpdated": "2026-09-28T16:32:29.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63336 (GCVE-0-2026-63336)

Vulnerability from cvelistv5 – Published: 2026-08-18 16:29 – Updated: 2026-08-18 17:34
VLAI
Title
RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM
Summary
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol() and ConnectionFactory.useSslProtocol(String) configure com.rabbitmq.client.TrustEverythingTrustManager and leave hostname verification disabled, causing arbitrary server certificates, including self-signed certificates, to be accepted. A network attacker able to intercept a TLS connection can impersonate the RabbitMQ broker, read protected AMQP traffic, and modify traffic without certificate or hostname validation. The fix changes the production TLS helpers to use the JVM default trust store and enables hostname verification, while retaining an explicitly named development-only no-verification helper. This issue is fixed in version 5.33.0.
Severity
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:30 UTC
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7639 records in the last 180 days details
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63336",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T17:30:07.570827Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T17:34:30.102Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5m9f-rphj-c435"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rabbitmq-java-client",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.33.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol() and ConnectionFactory.useSslProtocol(String) configure com.rabbitmq.client.TrustEverythingTrustManager and leave hostname verification disabled, causing arbitrary server certificates, including self-signed certificates, to be accepted. A network attacker able to intercept a TLS connection can impersonate the RabbitMQ broker, read protected AMQP traffic, and modify traffic without certificate or hostname validation. The fix changes the production TLS helpers to use the JVM default trust store and enables hostname verification, while retaining an explicitly named development-only no-verification helper. This issue is fixed in version 5.33.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T16:29:23.115Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5m9f-rphj-c435",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5m9f-rphj-c435"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-java-client/pull/1999",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-java-client/pull/1999"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-java-client/pull/2001",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-java-client/pull/2001"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.0"
        }
      ],
      "source": {
        "advisory": "GHSA-5m9f-rphj-c435",
        "discovery": "UNKNOWN"
      },
      "title": "RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63336",
    "datePublished": "2026-08-18T16:29:23.115Z",
    "dateReserved": "2026-07-16T14:14:24.385Z",
    "dateUpdated": "2026-08-18T17:34:30.102Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-61668 (GCVE-0-2026-61668)

Vulnerability from cvelistv5 – Published: 2026-09-15 17:29 – Updated: 2026-09-17 16:33
VLAI
Title
DIRAC: Pilot code downloaded over unverified HTTPS connection
Summary
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl._create_unverified_context to download the second-stage pilot.tar archive without TLS certificate verification and downloads the reference checksum through the same unvalidated channel. An attacker able to redirect or intercept a grid site's network traffic through DNS or routing manipulation can substitute both the executable pilot code and its checksum, causing arbitrary code to run in the pilot context with access to pilot proxy credentials. The fixed implementation validates the server certificate through system trust and X509_CERT_DIR or the grid certificate directory. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 16:33 UTC
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7639 records in the last 180 days details
References
Impacted products
Vendor Product Version
DIRACGrid DIRAC Affected: >= 6.20.1, < 8.0.79
Affected: >= 9.0.0a1, < 9.0.22
Affected: >= 9.1.0, < 9.1.10
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61668",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T16:33:29.548391Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T16:33:44.753Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "DIRAC",
          "vendor": "DIRACGrid",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.20.1, \u003c 8.0.79"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0a1, \u003c 9.0.22"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.1.0, \u003c 9.1.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl._create_unverified_context to download the second-stage pilot.tar archive without TLS certificate verification and downloads the reference checksum through the same unvalidated channel. An attacker able to redirect or intercept a grid site\u0027s network traffic through DNS or routing manipulation can substitute both the executable pilot code and its checksum, causing arbitrary code to run in the pilot context with access to pilot proxy credentials. The fixed implementation validates the server certificate through system trust and X509_CERT_DIR or the grid certificate directory. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:29:26.029Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-vg99-gr89-qhw9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-vg99-gr89-qhw9"
        },
        {
          "name": "https://github.com/DIRACGrid/DIRAC/commit/68029dfb5ddd8b1e4106851f8e37370aa80ac7ae",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DIRACGrid/DIRAC/commit/68029dfb5ddd8b1e4106851f8e37370aa80ac7ae"
        },
        {
          "name": "https://github.com/DIRACGrid/DIRAC/commit/92e2e26c63b964b8499bee5e9c2e2821a36eac56",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DIRACGrid/DIRAC/commit/92e2e26c63b964b8499bee5e9c2e2821a36eac56"
        },
        {
          "name": "https://github.com/DIRACGrid/DIRAC/commit/b332c437d064f66ee46f5b45a90a9f7c4bace38d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DIRACGrid/DIRAC/commit/b332c437d064f66ee46f5b45a90a9f7c4bace38d"
        },
        {
          "name": "https://github.com/DIRACGrid/DIRAC/releases/tag/v8.0.79",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DIRACGrid/DIRAC/releases/tag/v8.0.79"
        },
        {
          "name": "https://github.com/DIRACGrid/DIRAC/releases/tag/v9.0.22",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DIRACGrid/DIRAC/releases/tag/v9.0.22"
        },
        {
          "name": "https://github.com/DIRACGrid/DIRAC/releases/tag/v9.1.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DIRACGrid/DIRAC/releases/tag/v9.1.10"
        }
      ],
      "source": {
        "advisory": "GHSA-vg99-gr89-qhw9",
        "discovery": "UNKNOWN"
      },
      "title": "DIRAC: Pilot code downloaded over unverified HTTPS connection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61668",
    "datePublished": "2026-09-15T17:29:26.029Z",
    "dateReserved": "2026-07-10T18:25:21.467Z",
    "dateUpdated": "2026-09-17T16:33:44.753Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59836 (GCVE-0-2026-59836)

Vulnerability from cvelistv5 – Published: 2026-07-14 15:15 – Updated: 2026-07-15 03:59
VLAI
Summary
A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow attacker to information disclosure via <insert attack vector here>
Severity
6.7 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-14 00:00 UTC
CWE
Assigner
fortinet CNA under the mitre root
CNA scorecard C 72/100 over 56 records in the last 180 days details
References
Impacted products
Vendor Product Version
Fortinet FortiClientEMS Affected: 7.4.3 , ≤ 7.4.5 (semver)
Affected: 7.4.0 , ≤ 7.4.1 (semver)
Affected: 7.2.12 , ≤ 7.2.14 (semver)
Affected: 7.2.0 , ≤ 7.2.10 (semver)
    cpe:2.3:a:fortinet:forticlientems:7.4.5:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.2.14:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.2.13:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.2.12:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.2.10:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.2.9:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.2.8:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.2.7:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:forticlientems:7.2.0:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59836",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T03:59:06.023Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:forticlientems:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.2.14:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.2.13:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.2.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientems:7.2.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiClientEMS",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.4.5",
              "status": "affected",
              "version": "7.4.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.1",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.14",
              "status": "affected",
              "version": "7.2.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.10",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow attacker to information disclosure via \u003cinsert attack vector here\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Information disclosure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T15:15:08.063Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-147",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-147"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to upcoming  FortiClientEMS version 8.0.0 or above\nUpgrade to FortiClientEMS version 7.4.6 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2026-59836",
    "datePublished": "2026-07-14T15:15:08.063Z",
    "dateReserved": "2026-07-07T15:21:26.614Z",
    "dateUpdated": "2026-07-15T03:59:06.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59825 (GCVE-0-2026-59825)

Vulnerability from cvelistv5 – Published: 2026-08-18 15:07 – Updated: 2026-08-18 15:51
VLAI
Title
Mastodon: Unwanted deactivation of SSL/TLS certificate verification
Summary
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq background jobs remain unaffected. This issue is fixed in versions 4.4.19 and 4.5.12.
Severity
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 15:51 UTC
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7639 records in the last 180 days details
References
Impacted products
Vendor Product Version
mastodon mastodon Affected: < 4.4.19
Affected: >= 4.5.0, < 4.5.12
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59825",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T15:51:09.488217Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T15:51:15.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mastodon",
          "vendor": "mastodon",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.4.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.5.0, \u003c 4.5.12"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon\u0027s app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq background jobs remain unaffected. This issue is fixed in versions 4.4.19 and 4.5.12."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T15:07:14.555Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-3rhr-8phh-jm86",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-3rhr-8phh-jm86"
        },
        {
          "name": "https://github.com/mastodon/mastodon/pull/39571",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mastodon/mastodon/pull/39571"
        },
        {
          "name": "https://github.com/mastodon/mastodon/commit/2ccb6ef277e725d1932295690cf8ab9d3dc03149",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mastodon/mastodon/commit/2ccb6ef277e725d1932295690cf8ab9d3dc03149"
        },
        {
          "name": "https://github.com/mastodon/mastodon/commit/5748d0b16ea09001e0933f76c7afe814e09652ef",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mastodon/mastodon/commit/5748d0b16ea09001e0933f76c7afe814e09652ef"
        },
        {
          "name": "https://github.com/mastodon/mastodon/commit/761c61b42590a2fd91442fc15a0a7583e48bbea4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mastodon/mastodon/commit/761c61b42590a2fd91442fc15a0a7583e48bbea4"
        },
        {
          "name": "https://github.com/mastodon/mastodon/releases/tag/v4.4.19",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mastodon/mastodon/releases/tag/v4.4.19"
        },
        {
          "name": "https://github.com/mastodon/mastodon/releases/tag/v4.5.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mastodon/mastodon/releases/tag/v4.5.12"
        }
      ],
      "source": {
        "advisory": "GHSA-3rhr-8phh-jm86",
        "discovery": "UNKNOWN"
      },
      "title": "Mastodon: Unwanted deactivation of SSL/TLS certificate verification"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59825",
    "datePublished": "2026-08-18T15:07:14.555Z",
    "dateReserved": "2026-07-07T15:00:50.978Z",
    "dateUpdated": "2026-08-18T15:51:15.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59818 (GCVE-0-2026-59818)

Vulnerability from cvelistv5 – Published: 2026-07-08 21:00 – Updated: 2026-07-09 13:13
VLAI
Title
etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation
Summary
etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-09 13:13 UTC
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7639 records in the last 180 days details
References
Impacted products
Vendor Product Version
etcd-io etcd Affected: >= 3.6.0-alpha.0, < 3.6.13
Affected: < 3.5.32
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59818",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T13:13:02.654220Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T13:13:10.463Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "etcd",
          "vendor": "etcd-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.6.0-alpha.0, \u003c 3.6.13"
            },
            {
              "status": "affected",
              "version": "\u003c 3.5.32"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T21:00:18.207Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/etcd-io/etcd/security/advisories/GHSA-3wh4-j44w-pg92",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-3wh4-j44w-pg92"
        },
        {
          "name": "https://github.com/etcd-io/etcd/pull/22007",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/pull/22007"
        },
        {
          "name": "https://github.com/etcd-io/etcd/pull/22021",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/pull/22021"
        },
        {
          "name": "https://github.com/etcd-io/etcd/pull/22025",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/pull/22025"
        },
        {
          "name": "https://github.com/etcd-io/etcd/commit/2308ce1578064641d4d67c40f0487309267d1bef",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/commit/2308ce1578064641d4d67c40f0487309267d1bef"
        },
        {
          "name": "https://github.com/etcd-io/etcd/commit/24838af5a53dd0245adced920e42a9bf0e7a267f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/commit/24838af5a53dd0245adced920e42a9bf0e7a267f"
        },
        {
          "name": "https://github.com/etcd-io/etcd/commit/8221ae82bc25d4d55ca64382207b69be71038cbb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/commit/8221ae82bc25d4d55ca64382207b69be71038cbb"
        },
        {
          "name": "https://github.com/etcd-io/etcd/releases/tag/v3.5.32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/releases/tag/v3.5.32"
        },
        {
          "name": "https://github.com/etcd-io/etcd/releases/tag/v3.6.13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/releases/tag/v3.6.13"
        }
      ],
      "source": {
        "advisory": "GHSA-3wh4-j44w-pg92",
        "discovery": "UNKNOWN"
      },
      "title": "etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59818",
    "datePublished": "2026-07-08T21:00:18.207Z",
    "dateReserved": "2026-07-07T15:00:50.978Z",
    "dateUpdated": "2026-07-09T13:13:10.463Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58162 (GCVE-0-2026-58162)

Vulnerability from cvelistv5 – Published: 2026-07-29 08:36 – Updated: 2026-10-01 17:01
VLAI
Title
Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates
Summary
The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Severity
10 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
8.4 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-29 13:40 UTC
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
apache CNA under the mitre root
CNA scorecard B 76/100 over 1024 records in the last 180 days details
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Traffic Server Affected: 8.0.0 , ≤ 8.1.11 (semver)
Affected: 9.0.0 , ≤ 9.2.14 (semver)
Affected: 10.0.0 , ≤ 10.1.3 (semver)
Create a notification for this product.
Credits
Omkhar Arasaratnam
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58162",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-29T13:40:58.146617Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T13:41:05.355Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Traffic Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "8.1.11",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.2.14",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.3",
              "status": "affected",
              "version": "10.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Omkhar Arasaratnam"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.\n\n\n\nUsers are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T17:01:01.772Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates",
      "x_generator": {
        "engine": "scripts/cve_render.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-58162",
    "datePublished": "2026-07-29T08:36:17.272Z",
    "dateReserved": "2026-06-29T15:51:05.609Z",
    "dateUpdated": "2026-10-01T17:01:01.772Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58062 (GCVE-0-2026-58062)

Vulnerability from cvelistv5 – Published: 2026-08-03 02:35 – Updated: 2026-08-03 18:27
VLAI
Title
Stapled OCSP response accepted without binding to the checked certificate
Summary
In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Severity
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 18:26 UTC
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
bcorg CNA under the mitre root
CNA scorecard B 84/100 over 74 records in the last 180 days details
References
Impacted products
Vendor Product Version
Legion of the Bouncy Castle Inc. BC-JAVA Affected: 1.66 , < 1.85 (maven)
Create a notification for this product.
Legion of the Bouncy Castle Inc. BC-LTS-JAVA Affected: 2.73.0 , < 2.73.12 (maven)
Create a notification for this product.
Legion of the Bouncy Castle Inc. BC-FJA Affected: 2.0.0 , < 2.0.2 (maven)
Affected: 2.1.0 , < 2.1.3 (maven)
Create a notification for this product.
Credits
Alex Gaynor in collaboration with Claude and Anthropic Research
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58062",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T18:26:59.650741Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T18:27:07.645Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "prov"
          ],
          "packageName": "bcprov",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "ProvOcspRevocationChecker"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "1.66",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected",
          "modules": [
            "prov"
          ],
          "packageName": "bcprov-lts8on",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-lts8on",
          "platforms": [
            "all"
          ],
          "product": "BC-LTS-JAVA",
          "programFiles": [
            "ProvOcspRevocationChecker"
          ],
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.73.12",
              "status": "affected",
              "version": "2.73.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
          "defaultStatus": "unaffected",
          "packageName": "bc-fips",
          "packageURL": "pkg:maven/org.bouncycastle/bc-fips",
          "platforms": [
            "all"
          ],
          "product": "BC-FJA",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.0.2",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.1.3",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alex Gaynor in collaboration with Claude and Anthropic Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T05:48:56.603Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9058062"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/add5f822660f3b2c29fd824e2f4095469c42a1c7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Stapled OCSP response accepted without binding to the checked certificate",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-58062",
    "datePublished": "2026-08-03T02:35:28.180Z",
    "dateReserved": "2026-06-28T01:21:46.334Z",
    "dateUpdated": "2026-08-03T18:27:07.645Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56820 (GCVE-0-2026-56820)

Vulnerability from cvelistv5 – Published: 2026-07-21 22:26 – Updated: 2026-07-24 20:12
VLAI
Title
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
Summary
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Severity
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-24 03:55 UTC
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7639 records in the last 180 days details
References
Impacted products
Vendor Product Version
netty netty Affected: >= 4.2.0.Final, < 4.2.16.Final
Affected: < 4.1.136.Final
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56820",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T03:55:59.408001Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T20:12:43.581Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netty",
          "vendor": "netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Final, \u003c 4.2.16.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.136.Final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T22:26:16.588Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwg"
        },
        {
          "name": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
        },
        {
          "name": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
        },
        {
          "name": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "name": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        }
      ],
      "source": {
        "advisory": "GHSA-272m-gcwp-mpwg",
        "discovery": "UNKNOWN"
      },
      "title": "Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56820",
    "datePublished": "2026-07-21T22:26:16.588Z",
    "dateReserved": "2026-06-23T14:55:09.116Z",
    "dateUpdated": "2026-07-24T20:12:43.581Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56624 (GCVE-0-2026-56624)

Vulnerability from cvelistv5 – Published: 2026-07-20 20:28 – Updated: 2026-07-23 03:56
VLAI
Title
Apache MINA SSHD: SSH certificate options lack validations
Summary
Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server. This issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions. The fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*-cert-v01@openssh.com user certificates (which are the only ones for which verify-required would make sense).
Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-22 00:00 UTC
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
apache CNA under the mitre root
CNA scorecard B 76/100 over 1024 records in the last 180 days details
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache MINA SSHD Affected: 2.0.0 , ≤ 2.18.0 (maven)
Affected: 3.0.0-M1 , ≤ 3.0.0-M4 (maven)
Create a notification for this product.
Credits
Mitchell Benjamin
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-20T22:20:01.873Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/20/17"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56624",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T03:56:23.660Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.sshd:sshd-core",
          "product": "Apache MINA SSHD",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.18.0",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "3.0.0-M4",
              "status": "affected",
              "version": "3.0.0-M1",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mitchell Benjamin"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eImproper certificate validation in Apache MINA SSHD (server-side).\u0026nbsp;Apache MINA SSHD is a Java library for client-side and server-side SSH.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eServer-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThis issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThe fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*-cert-v01@openssh.com user certificates (which are the only ones for which verify-required would make sense).\u003c/div\u003e"
            }
          ],
          "value": "Improper certificate validation in Apache MINA SSHD (server-side).\u00a0Apache MINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nServer-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server.\n\n\n\n\nThis issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions.\n\n\n\n\nThe fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*-cert-v01@openssh.com user certificates (which are the only ones for which verify-required would make sense)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-20T20:28:26.333Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache MINA SSHD: SSH certificate options lack validations",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-56624",
    "datePublished": "2026-07-20T20:28:26.333Z",
    "dateReserved": "2026-06-22T15:05:27.038Z",
    "dateUpdated": "2026-07-23T03:56:23.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Architecture and Design Implementation

Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.

Mitigation
Implementation

If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

CAPEC-459: Creating a Rogue Certification Authority Certificate

An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.

CAPEC-475: Signature Spoofing by Improper Validation

An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.

← Back to the CWE list