Common Weakness Enumeration
CWE-297
AllowedImproper Validation of Certificate with Host Mismatch
Abstraction: Variant · Status: Incomplete
The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
156 vulnerabilities reference this CWE, most recent first.
GHSA-HW58-3793-42GG
Vulnerability from github – Published: 2025-04-30 17:24 – Updated: 2025-08-07 15:47
VLAI
Summary
Keycloak hostname verification
Details
A flaw was found in Keycloak. By setting a verification policy to 'ANY', the trust store certificate verification is skipped, which is unintended.
Severity
8.2 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-3501"
],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-30T17:24:21Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "A flaw was found in Keycloak. By setting a verification policy to \u0027ANY\u0027, the trust store certificate verification is skipped, which is unintended.",
"id": "GHSA-hw58-3793-42gg",
"modified": "2025-08-07T15:47:35Z",
"published": "2025-04-30T17:24:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-hw58-3793-42gg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3501"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/issues/39350"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/pull/39366"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/99ca24c832729075e04d8bc58666089268314272"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4335"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4336"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-3501"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2358834"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Keycloak hostname verification"
}
GHSA-HWRJ-9RR4-24XH
Vulnerability from github – Published: 2026-07-27 12:31 – Updated: 2026-09-02 14:31
VLAI
Summary
Apache Thrift Python bindings have a Improper Validation of Certificate with Host Mismatch vulnerabilit
Details
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
This replaces CVE-2026-41603
Severity
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "thrift"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.24.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-66053"
],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-02T14:31:34Z",
"nvd_published_at": "2026-07-27T12:16:55Z",
"severity": "MODERATE"
},
"details": "Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings.\n\nThis issue affects Apache Thrift: before 0.24.0.\n\nUsers are recommended to upgrade to version 0.24.0, which fixes the issue.\n\nThis replaces\u00a0CVE-2026-41603",
"id": "GHSA-hwrj-9rr4-24xh",
"modified": "2026-09-02T14:31:34Z",
"published": "2026-07-27T12:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66053"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/thrift"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/w4k5dnv1x58knwlhpo9x0or5xh220y65"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Thrift Python bindings have a Improper Validation of Certificate with Host Mismatch vulnerabilit"
}
GHSA-JM94-9F7H-36PR
Vulnerability from github – Published: 2026-07-03 09:31 – Updated: 2026-07-06 21:30
VLAI
Details
When a user invokes curl using a schemeless URL combined with
--proto-default sftp (or scp), a disconnect occurs between the tool layer
and libcurl. The tool layer incorrectly infers the URL scheme, which
erroneously bypasses the initialization of critical SSH security options like
CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the
libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes
the connection via SFTP/SCP as specified. Because the tool layer skipped the
security configuration, these SSH host verification options are silently
omitted, causing curl to connect to an unverified SSH remote host without
throwing an error.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2026-12064"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-297"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-03T07:16:24Z",
"severity": "HIGH"
},
"details": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.",
"id": "GHSA-jm94-9f7h-36pr",
"modified": "2026-07-06T21:30:31Z",
"published": "2026-07-03T09:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12064"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3797526"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2026-12064.html"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2026-12064.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JW9P-3GC4-84RW
Vulnerability from github – Published: 2024-09-03 15:30 – Updated: 2024-09-05 15:33
VLAI
Details
Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection. This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security. The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation.
Severity
7.2 (High)
{
"affected": [],
"aliases": [
"CVE-2024-7346"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-297"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-03T15:15:16Z",
"severity": "HIGH"
},
"details": "Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection.\u00a0 This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security.\u00a0 The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation.",
"id": "GHSA-jw9p-3gc4-84rw",
"modified": "2024-09-05T15:33:34Z",
"published": "2024-09-03T15:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7346"
},
{
"type": "WEB",
"url": "https://community.progress.com/s/article/Client-connections-using-default-TLS-certificates-from-OpenEdge-may-bypass-TLS-host-name-validation"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P2C7-C4GW-678H
Vulnerability from github – Published: 2026-07-27 12:31 – Updated: 2026-07-27 21:31
VLAI
Details
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-48145"
],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-27T12:16:44Z",
"severity": "HIGH"
},
"details": "Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings.\n\nThis issue affects Apache Thrift: before 0.24.0.\n\nUsers are recommended to upgrade to version 0.24.0, which fixes the issue.",
"id": "GHSA-p2c7-c4gw-678h",
"modified": "2026-07-27T21:31:21Z",
"published": "2026-07-27T12:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48145"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/2popgc4ks1l87jjho1w5fpk5k4x06b7h"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/07/24/36"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PX2C-R924-MWCC
Vulnerability from github – Published: 2025-06-18 15:31 – Updated: 2025-06-18 19:42
VLAI
Summary
Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates
Details
The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.
Severity
4.9 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 3.7.1"
},
"package": {
"ecosystem": "NuGet",
"name": "CouchbaseNetClient"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-49015"
],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-18T19:42:25Z",
"nvd_published_at": "2025-06-18T14:15:44Z",
"severity": "MODERATE"
},
"details": "The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.",
"id": "GHSA-px2c-r924-mwcc",
"modified": "2025-06-18T19:42:25Z",
"published": "2025-06-18T15:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49015"
},
{
"type": "WEB",
"url": "https://github.com/couchbase/couchbase-net-client/commit/04d1679b2178f922036be6e595b3d91f972c5ba3"
},
{
"type": "WEB",
"url": "https://docs.couchbase.com/server/current/release-notes/relnotes.html"
},
{
"type": "WEB",
"url": "https://forums.couchbase.com/tags/security"
},
{
"type": "PACKAGE",
"url": "https://github.com/couchbase/couchbase-net-client"
},
{
"type": "WEB",
"url": "https://www.couchbase.com/alerts"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates"
}
GHSA-PXP5-G66H-WPV2
Vulnerability from github – Published: 2022-09-22 00:00 – Updated: 2022-12-06 19:54
VLAI
Summary
Missing hostname validation in Jenkins View26 Test-Reporting Plugin
Details
Jenkins View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a man-in-the-middle attack to intercept these connections.
Severity
4.8 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:view26"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-41244"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-297"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-23T13:30:36Z",
"nvd_published_at": "2022-09-21T16:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a man-in-the-middle attack to intercept these connections.",
"id": "GHSA-pxp5-g66h-wpv2",
"modified": "2022-12-06T19:54:53Z",
"published": "2022-09-22T00:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41244"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/view26-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2069"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Missing hostname validation in Jenkins View26 Test-Reporting Plugin"
}
GHSA-QR4J-JP4M-6JHM
Vulnerability from github – Published: 2026-08-10 12:31 – Updated: 2026-08-10 21:32
VLAI
Details
TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2026-65942"
],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-10T11:17:27Z",
"severity": "HIGH"
},
"details": "TLS hostname verification issue in Apache Ranger Client Code in versions \u003c= 2.8.0.\nUsers are recommended to upgrade to version 2.9.0, which fixes this issue.",
"id": "GHSA-qr4j-jp4m-6jhm",
"modified": "2026-08-10T21:32:02Z",
"published": "2026-08-10T12:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65942"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/pp6on4yyht3z8l0ktfo1xydhjzjbn4gt"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/08/09/9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R4C5-645C-GFXV
Vulnerability from github – Published: 2026-10-08 18:32 – Updated: 2026-10-08 18:32
VLAI
Details
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.
Severity
4.8 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-107660"
],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-08T16:17:04Z",
"severity": "MODERATE"
},
"details": "FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.",
"id": "GHSA-r4c5-645c-gfxv",
"modified": "2026-10-08T18:32:28Z",
"published": "2026-10-08T18:32:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107660"
},
{
"type": "WEB",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549f"
},
{
"type": "WEB",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/57a2e704b4a6eda5d061b45aacde6b19c026bfc0"
},
{
"type": "WEB",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/d377212904a19fc740d721cbda0ba58fa3805a29"
},
{
"type": "WEB",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24383"
},
{
"type": "WEB",
"url": "https://ffmpeg.org"
},
{
"type": "WEB",
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavformat/tls_mbedtls.c#L676-L681"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-mbedtls-hostname-verification-bypass-for-ip-hosts"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-R4MC-2XRG-97HV
Vulnerability from github – Published: 2023-09-01 12:30 – Updated: 2024-04-04 07:21
VLAI
Details
An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and 6.0.x; FortiSandbox 4.0.x, 3.2.x and 3.1.x may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the listed products and some external peers.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-22305"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-297"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-01T12:15:08Z",
"severity": "MODERATE"
},
"details": "An improper certificate validation vulnerability [CWE-295] in\u00a0FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and 6.0.x; FortiSandbox 4.0.x, 3.2.x and 3.1.x may allow a network adjacent and unauthenticated attacker to\u00a0man-in-the-middle the communication between the listed products and some external peers.",
"id": "GHSA-r4mc-2xrg-97hv",
"modified": "2024-04-04T07:21:33Z",
"published": "2023-09-01T12:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22305"
},
{
"type": "WEB",
"url": "https://fortiguard.com/psirt/FG-IR-18-292"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
Fully check the hostname of the certificate and provide the user with adequate information about the nature of the problem and how to proceed.
Mitigation
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
No CAPEC attack patterns related to this CWE.