Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1390
Vulnerability from certfr_avis - Published: 2026-10-27 - Updated: 2026-10-27
De multiples vulnérabilités ont été découvertes dans Tenable Network Monitor. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Tenable | Network Monitor | Network Monitor versions antérieures à 6.6.0 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Network Monitor versions ant\u00e9rieures \u00e0 6.6.0",
"product": {
"name": "Network Monitor",
"vendor": {
"name": "Tenable",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-56404",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56404"
},
{
"name": "CVE-2026-34180",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34180"
},
{
"name": "CVE-2026-75806",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75806"
},
{
"name": "CVE-2026-77696",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77696"
},
{
"name": "CVE-2026-42766",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42766"
},
{
"name": "CVE-2026-1965",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1965"
},
{
"name": "CVE-2026-34181",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34181"
},
{
"name": "CVE-2026-35189",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-35189"
},
{
"name": "CVE-2026-8926",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8926"
},
{
"name": "CVE-2026-84784",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84784"
},
{
"name": "CVE-2026-11352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11352"
},
{
"name": "CVE-2026-3783",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3783"
},
{
"name": "CVE-2026-63074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63074"
},
{
"name": "CVE-2026-8458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8458"
},
{
"name": "CVE-2026-6429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6429"
},
{
"name": "CVE-2026-86139",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86139"
},
{
"name": "CVE-2026-56131",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56131"
},
{
"name": "CVE-2026-66046",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66046"
},
{
"name": "CVE-2026-86142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86142"
},
{
"name": "CVE-2026-56410",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56410"
},
{
"name": "CVE-2026-9546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9546"
},
{
"name": "CVE-2026-63073",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63073"
},
{
"name": "CVE-2026-14456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14456"
},
{
"name": "CVE-2026-14457",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14457"
},
{
"name": "CVE-2026-8932",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8932"
},
{
"name": "CVE-2026-45186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45186"
},
{
"name": "CVE-2026-56412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56412"
},
{
"name": "CVE-2026-54875",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54875"
},
{
"name": "CVE-2026-77214",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77214"
},
{
"name": "CVE-2026-42772",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42772"
},
{
"name": "CVE-2026-11586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11586"
},
{
"name": "CVE-2026-6253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6253"
},
{
"name": "CVE-2026-7009",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-7009"
},
{
"name": "CVE-2026-54873",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54873"
},
{
"name": "CVE-2026-76641",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76641"
},
{
"name": "CVE-2026-76781",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76781"
},
{
"name": "CVE-2026-8924",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8924"
},
{
"name": "CVE-2026-3805",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3805"
},
{
"name": "CVE-2026-9079",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9079"
},
{
"name": "CVE-2026-63075",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63075"
},
{
"name": "CVE-2026-56407",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56407"
},
{
"name": "CVE-2026-86137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86137"
},
{
"name": "CVE-2026-76956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76956"
},
{
"name": "CVE-2026-0990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0990"
},
{
"name": "CVE-2026-9080",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9080"
},
{
"name": "CVE-2026-56405",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56405"
},
{
"name": "CVE-2026-63076",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63076"
},
{
"name": "CVE-2026-72897",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72897"
},
{
"name": "CVE-2026-56411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56411"
},
{
"name": "CVE-2026-9545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9545"
},
{
"name": "CVE-2026-18798",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18798"
},
{
"name": "CVE-2026-34183",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34183"
},
{
"name": "CVE-2026-56406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56406"
},
{
"name": "CVE-2026-1757",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1757"
},
{
"name": "CVE-2026-56408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56408"
},
{
"name": "CVE-2026-86141",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86141"
},
{
"name": "CVE-2026-42767",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42767"
},
{
"name": "CVE-2026-50219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50219"
},
{
"name": "CVE-2026-56403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56403"
},
{
"name": "CVE-2026-4873",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4873"
},
{
"name": "CVE-2026-11979",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11979"
},
{
"name": "CVE-2026-93990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93990"
},
{
"name": "CVE-2026-8925",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8925"
},
{
"name": "CVE-2026-56409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56409"
},
{
"name": "CVE-2026-42764",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42764"
},
{
"name": "CVE-2026-86144",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86144"
},
{
"name": "CVE-2026-75803",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75803"
},
{
"name": "CVE-2026-54872",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54872"
},
{
"name": "CVE-2026-5773",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5773"
},
{
"name": "CVE-2026-8927",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8927"
},
{
"name": "CVE-2026-6276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6276"
},
{
"name": "CVE-2026-0992",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0992"
},
{
"name": "CVE-2026-75805",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75805"
},
{
"name": "CVE-2026-102633",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102633"
},
{
"name": "CVE-2026-11564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11564"
},
{
"name": "CVE-2026-34182",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34182"
},
{
"name": "CVE-2026-86138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86138"
},
{
"name": "CVE-2026-86140",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86140"
},
{
"name": "CVE-2026-74860",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74860"
},
{
"name": "CVE-2026-35191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-35191"
},
{
"name": "CVE-2026-9547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9547"
},
{
"name": "CVE-2026-56132",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56132"
},
{
"name": "CVE-2026-54874",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54874"
},
{
"name": "CVE-2026-7168",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-7168"
},
{
"name": "CVE-2026-76957",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76957"
},
{
"name": "CVE-2026-6732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6732"
},
{
"name": "CVE-2026-75804",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75804"
},
{
"name": "CVE-2026-86143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86143"
},
{
"name": "CVE-2026-8286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8286"
},
{
"name": "CVE-2026-0989",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0989"
},
{
"name": "CVE-2026-63072",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63072"
},
{
"name": "CVE-2026-5545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5545"
},
{
"name": "CVE-2026-3784",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3784"
}
],
"initial_release_date": "2026-10-27T00:00:00",
"last_revision_date": "2026-10-27T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1390",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-27T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Tenable Network Monitor. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Tenable Network Monitor",
"vendor_advisories": [
{
"published_at": "2026-10-26",
"title": "Bulletin de s\u00e9curit\u00e9 Tenable tns-2026-32",
"url": "https://www.tenable.com/security/tns-2026-32"
}
]
}
CVE-2026-63073 (GCVE-0-2026-63073)
Vulnerability from cvelistv5 – Published: 2026-08-25 12:59 – Updated: 2026-08-31 19:12
VLAI
EPSS
VEX
Title
Untrusted Sender DN Used as Format String in CMP Response Validation
Summary
Issue summary: OpenSSL CMP response validation passed an unexpected response
sender distinguished name directly as the format string to `ERR_raise_data()`.
Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client
that enforces an expected sender or uses a pinned server certificate whose
subject becomes the default expected sender.
CWE: CWE-134 (Use of Externally-Controlled Format String)
Description: When validating a received CMP message, ossl_cmp_msg_check_update()
converts the peer-supplied sender distinguished name with X509_NAME_oneline()
and passes it directly as the format argument to ERR_raise_data(). Percent
characters survive the conversion, so a sender DN such as "CN=%s%n" reaches
BIO_vsnprintf() as an attacker-controlled format string with no matching variadic
arguments. This path is only reached when the caller configures an expected
sender or pins a server certificate, which is the normal configuration for a
CMP client validating server responses.
Since the attacker controls the format string but none of the variadic
arguments, such specifiers as %s and %n dereference or write through unrelated
stack contents and crash the client. The reliable consequence is a denial of
service, when the response comes from a malicious or intercepted CMP endpoint.
There is no controlled memory write, arbitrary-address read, or reliable path
to remote code execution.
FIPS impact: no
No FIPS modules are affected by this issue, as the CMP protocol
implementation is outside the OpenSSL FIPS module boundary.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 19:12 UTC
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
5 references
Impacted products
Date Public
2026-08-25 11:36
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-63073",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T19:12:48.434586Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T19:12:54.136Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenSSL",
"vendor": "OpenSSL",
"versions": [
{
"lessThan": "4.0.2",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"lessThan": "3.6.4",
"status": "affected",
"version": "3.6.0",
"versionType": "semver"
},
{
"lessThan": "3.5.8",
"status": "affected",
"version": "3.5.0",
"versionType": "semver"
},
{
"lessThan": "3.4.7",
"status": "affected",
"version": "3.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Filipe Casal (Trail of Bits)"
},
{
"lang": "en",
"type": "reporter",
"value": "Brandon Luo"
},
{
"lang": "en",
"type": "reporter",
"value": "TrendAI Zero Day Initiative"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Filipe Casal (Trail of Bits)"
}
],
"datePublic": "2026-08-25T11:36:16.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Issue summary: OpenSSL CMP response validation passed an unexpected response\u003cbr\u003esender distinguished name directly as the format string to `ERR_raise_data()`.\u003cbr\u003e\u003cbr\u003eImpact summary: A malicious or intercepted CMP endpoint can crash a CMP client\u003cbr\u003ethat enforces an expected sender or uses a pinned server certificate whose\u003cbr\u003esubject becomes the default expected sender.\u003cbr\u003e\u003cbr\u003eCWE: CWE-134 (Use of Externally-Controlled Format String)\u003cbr\u003e\u003cbr\u003eDescription: When validating a received CMP message, ossl_cmp_msg_check_update()\u003cbr\u003econverts the peer-supplied sender distinguished name with X509_NAME_oneline()\u003cbr\u003eand passes it directly as the format argument to ERR_raise_data(). Percent\u003cbr\u003echaracters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches\u003cbr\u003eBIO_vsnprintf() as an attacker-controlled format string with no matching variadic\u003cbr\u003earguments. This path is only reached when the caller configures an expected\u003cbr\u003esender or pins a server certificate, which is the normal configuration for a\u003cbr\u003eCMP client validating server responses.\u003cbr\u003e\u003cbr\u003eSince the attacker controls the format string but none of the variadic\u003cbr\u003earguments, such specifiers as %s and %n dereference or write through unrelated\u003cbr\u003estack contents and crash the client. The reliable consequence is a denial of\u003cbr\u003eservice, when the response comes from a malicious or intercepted CMP endpoint.\u003cbr\u003eThere is no controlled memory write, arbitrary-address read, or reliable path\u003cbr\u003eto remote code execution.\u003cbr\u003e\u003cbr\u003eFIPS impact: no\u003cbr\u003e\u003cbr\u003eNo FIPS modules are affected by this issue, as the CMP protocol\u003cbr\u003eimplementation is outside the OpenSSL FIPS module boundary."
}
],
"value": "Issue summary: OpenSSL CMP response validation passed an unexpected response\nsender distinguished name directly as the format string to `ERR_raise_data()`.\n\nImpact summary: A malicious or intercepted CMP endpoint can crash a CMP client\nthat enforces an expected sender or uses a pinned server certificate whose\nsubject becomes the default expected sender.\n\nCWE: CWE-134 (Use of Externally-Controlled Format String)\n\nDescription: When validating a received CMP message, ossl_cmp_msg_check_update()\nconverts the peer-supplied sender distinguished name with X509_NAME_oneline()\nand passes it directly as the format argument to ERR_raise_data(). Percent\ncharacters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches\nBIO_vsnprintf() as an attacker-controlled format string with no matching variadic\narguments. This path is only reached when the caller configures an expected\nsender or pins a server certificate, which is the normal configuration for a\nCMP client validating server responses.\n\nSince the attacker controls the format string but none of the variadic\narguments, such specifiers as %s and %n dereference or write through unrelated\nstack contents and crash the client. The reliable consequence is a denial of\nservice, when the response comes from a malicious or intercepted CMP endpoint.\nThere is no controlled memory write, arbitrary-address read, or reliable path\nto remote code execution.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary."
}
],
"metrics": [
{
"format": "other",
"other": {
"content": {
"text": "Low"
},
"type": "https://openssl-library.org/policies/general/security-policy/"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T12:59:43.356Z",
"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"shortName": "openssl"
},
"references": [
{
"name": "OpenSSL Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://openssl-library.org/news/secadv/20260825.txt"
},
{
"name": "4.0.2 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21"
},
{
"name": "3.6.4 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29"
},
{
"name": "3.5.8 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca"
},
{
"name": "3.4.7 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Untrusted Sender DN Used as Format String in CMP Response Validation",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"assignerShortName": "openssl",
"cveId": "CVE-2026-63073",
"datePublished": "2026-08-25T12:59:43.356Z",
"dateReserved": "2026-07-15T13:10:26.188Z",
"dateUpdated": "2026-08-31T19:12:54.136Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63074 (GCVE-0-2026-63074)
Vulnerability from cvelistv5 – Published: 2026-08-25 12:59 – Updated: 2026-08-25 14:36
VLAI
EPSS
VEX
Title
CMP Indefinite Cache Growth of ExtraCerts
Summary
Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches
additional certificates (extraCerts) sent in a CMP message, but never expunges
them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX
frequently, this cache of extraCerts may grow unboundedly, and a malicious
client may flood a CMP server with requests driving this growth.
Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX
for the lifetime of a server process may observe unbounded memory growth in the
event a malicious client repeatedly sends requests containing unique extra
certificates, which may lead to OOM conditions.
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Description: If a remote user sends CMP messages to a server with a list of
extraCerts and the message is rejected, the extraCerts from the message remains
in the server contexts untrusted certificate stack. This exposes servers with
long lived ctx objects to Denial of Service attacks in which an attacker sends
messages intending to be rejected with a large list of additional certificates
repeatedly, forcing the server to store them indefinitely.
The issue was fixed by removing the added extra certs if the message is
rejected, using the same method as when the context is configured to not do
caching at all.
FIPS impact: no
As the CMP code lives outside the FIPS module boundary, no FIPS
modules are affected by this CVE.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 14:36 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
6 references
Impacted products
Date Public
2026-08-25 11:36
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-63074",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T14:36:10.702053Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T14:36:13.170Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenSSL",
"vendor": "OpenSSL",
"versions": [
{
"lessThan": "4.0.2",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"lessThan": "3.6.4",
"status": "affected",
"version": "3.6.0",
"versionType": "semver"
},
{
"lessThan": "3.5.8",
"status": "affected",
"version": "3.5.0",
"versionType": "semver"
},
{
"lessThan": "3.4.7",
"status": "affected",
"version": "3.4.0",
"versionType": "semver"
},
{
"lessThan": "3.0.22",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Pav\u043el \u017d\u00e1\u010dik (Red Hat)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Neil Horman"
}
],
"datePublic": "2026-08-25T11:36:16.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches\u003cbr\u003eadditional certificates (extraCerts) sent in a CMP message, but never expunges\u003cbr\u003ethem (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX\u003cbr\u003efrequently, this cache of extraCerts may grow unboundedly, and a malicious\u003cbr\u003eclient may flood a CMP server with requests driving this growth.\u003cbr\u003e\u003cbr\u003eImpact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX\u003cbr\u003efor the lifetime of a server process may observe unbounded memory growth in the\u003cbr\u003eevent a malicious client repeatedly sends requests containing unique extra\u003cbr\u003ecertificates, which may lead to OOM conditions.\u003cbr\u003e\u003cbr\u003eCWE: CWE-770: Allocation of Resources Without Limits or Throttling\u003cbr\u003e\u003cbr\u003eDescription: If a remote user sends CMP messages to a server with a list of\u003cbr\u003eextraCerts and the message is rejected, the extraCerts from the message remains\u003cbr\u003ein the server contexts untrusted certificate stack. This exposes servers with\u003cbr\u003elong lived ctx objects to Denial of Service attacks in which an attacker sends\u003cbr\u003emessages intending to be rejected with a large list of additional certificates\u003cbr\u003erepeatedly, forcing the server to store them indefinitely.\u003cbr\u003e \u003cbr\u003eThe issue was fixed by removing the added extra certs if the message is\u003cbr\u003erejected, using the same method as when the context is configured to not do\u003cbr\u003ecaching at all.\u003cbr\u003e\u003cbr\u003eFIPS impact: no\u003cbr\u003eAs the CMP code lives outside the FIPS module boundary, no FIPS\u003cbr\u003emodules are affected by this CVE."
}
],
"value": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches\nadditional certificates (extraCerts) sent in a CMP message, but never expunges\nthem (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX\nfrequently, this cache of extraCerts may grow unboundedly, and a malicious\nclient may flood a CMP server with requests driving this growth.\n\nImpact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX\nfor the lifetime of a server process may observe unbounded memory growth in the\nevent a malicious client repeatedly sends requests containing unique extra\ncertificates, which may lead to OOM conditions.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: If a remote user sends CMP messages to a server with a list of\nextraCerts and the message is rejected, the extraCerts from the message remains\nin the server contexts untrusted certificate stack. This exposes servers with\nlong lived ctx objects to Denial of Service attacks in which an attacker sends\nmessages intending to be rejected with a large list of additional certificates\nrepeatedly, forcing the server to store them indefinitely.\n \nThe issue was fixed by removing the added extra certs if the message is\nrejected, using the same method as when the context is configured to not do\ncaching at all.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."
}
],
"metrics": [
{
"format": "other",
"other": {
"content": {
"text": "Low"
},
"type": "https://openssl-library.org/policies/general/security-policy/"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T12:59:58.278Z",
"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"shortName": "openssl"
},
"references": [
{
"name": "OpenSSL Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://openssl-library.org/news/secadv/20260825.txt"
},
{
"name": "4.0.2 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/74ae7f6df47a5767c1010b88c47507dfc5b32c46"
},
{
"name": "3.6.4 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/01e567978a55fba18142a230380c31296049fae7"
},
{
"name": "3.5.8 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/75360af9650d4e0c82ba0050c5c9912cd79e54af"
},
{
"name": "3.4.7 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/f636f9ca0fa1bae5b42f9e787f025c96fb09c43a"
},
{
"name": "3.0.22 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/21a5d9658b0c66daace60e10ea18ff32a448de9f"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CMP Indefinite Cache Growth of ExtraCerts",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"assignerShortName": "openssl",
"cveId": "CVE-2026-63074",
"datePublished": "2026-08-25T12:59:58.278Z",
"dateReserved": "2026-07-15T13:10:26.188Z",
"dateUpdated": "2026-08-25T14:36:13.170Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63075 (GCVE-0-2026-63075)
Vulnerability from cvelistv5 – Published: 2026-08-25 13:00 – Updated: 2026-08-25 14:36
VLAI
EPSS
VEX
Title
QUIC ACK-only Packet Retention Can Cause Memory Exhaustion
Summary
Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly
sends ack-eliciting packets while not acknowledging ACK-only responses, the
QUIC stack can retain ACK-only packet metadata for the lifetime of the
connection.
Impact summary: A remote peer that can complete a QUIC handshake can
cause connection-scoped memory growth which may lead to Denial of Service
through memory exhaustion, especially with sustained traffic or many concurrent
QUIC connections.
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Description: When the OpenSSL QUIC stack sends an ACK-only packet,
there is no requirement by the QUIC protocol that the peer will acknowledge
that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL
implementation stores the metadata about the ACK frames regardless.
In and of itself that's ok, but if a malicious peer establishes a connection, and
then drives the connection such that ACK-only packets are forced from the
OpenSSL implementation peer (i.e., by sending numerous PING frames),
and then withholding any subsequent acks for ack-eliciting data, like
legitimate data, said malicious peer can force inappropriate memory growth
on the OpenSSL peer, potentially leading to a Denial of Service.
The fix is to ensure that we account for the transmission of the ACK-only
packet in the packet histories high and low watermark without actually storing
the ACK-only packet metadata itself.
FIPS impact: no
The OpenSSL FIPS module is not affected as the QUIC code is
outside the FIPS module boundary.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 14:36 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
5 references
Impacted products
Date Public
2026-08-25 11:36
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-63075",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T14:36:48.832724Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T14:36:51.928Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenSSL",
"vendor": "OpenSSL",
"versions": [
{
"lessThan": "4.0.2",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"lessThan": "3.6.4",
"status": "affected",
"version": "3.6.0",
"versionType": "semver"
},
{
"lessThan": "3.5.8",
"status": "affected",
"version": "3.5.0",
"versionType": "semver"
},
{
"lessThan": "3.4.7",
"status": "affected",
"version": "3.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Opal Wright (Trail of Bits)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Neil Horman"
}
],
"datePublic": "2026-08-25T11:36:16.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly\u003cbr\u003esends ack-eliciting packets while not acknowledging ACK-only responses, the\u003cbr\u003eQUIC stack can retain ACK-only packet metadata for the lifetime of the\u003cbr\u003econnection.\u003cbr\u003e\u003cbr\u003eImpact summary: A remote peer that can complete a QUIC handshake can\u003cbr\u003ecause connection-scoped memory growth which may lead to Denial of Service\u003cbr\u003ethrough memory exhaustion, especially with sustained traffic or many concurrent\u003cbr\u003eQUIC connections.\u003cbr\u003e\u003cbr\u003eCWE: CWE-770: Allocation of Resources Without Limits or Throttling\u003cbr\u003e\u003cbr\u003eDescription: When the OpenSSL QUIC stack sends an ACK-only packet,\u003cbr\u003ethere is no requirement by the QUIC protocol that the peer will acknowledge\u003cbr\u003ethat ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL\u003cbr\u003eimplementation stores the metadata about the ACK frames regardless.\u003cbr\u003eIn and of itself that\u0027s ok, but if a malicious peer establishes a connection, and\u003cbr\u003ethen drives the connection such that ACK-only packets are forced from the \u003cbr\u003eOpenSSL implementation peer (i.e., by sending numerous PING frames),\u003cbr\u003eand then withholding any subsequent acks for ack-eliciting data, like\u003cbr\u003elegitimate data, said malicious peer can force inappropriate memory growth\u003cbr\u003eon the OpenSSL peer, potentially leading to a Denial of Service.\u003cbr\u003e\u003cbr\u003eThe fix is to ensure that we account for the transmission of the ACK-only\u003cbr\u003epacket in the packet histories high and low watermark without actually storing\u003cbr\u003ethe ACK-only packet metadata itself.\u003cbr\u003e\u003cbr\u003eFIPS impact: no\u003cbr\u003eThe OpenSSL FIPS module is not affected as the QUIC code is\u003cbr\u003eoutside the FIPS module boundary."
}
],
"value": "Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly\nsends ack-eliciting packets while not acknowledging ACK-only responses, the\nQUIC stack can retain ACK-only packet metadata for the lifetime of the\nconnection.\n\nImpact summary: A remote peer that can complete a QUIC handshake can\ncause connection-scoped memory growth which may lead to Denial of Service\nthrough memory exhaustion, especially with sustained traffic or many concurrent\nQUIC connections.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: When the OpenSSL QUIC stack sends an ACK-only packet,\nthere is no requirement by the QUIC protocol that the peer will acknowledge\nthat ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL\nimplementation stores the metadata about the ACK frames regardless.\nIn and of itself that\u0027s ok, but if a malicious peer establishes a connection, and\nthen drives the connection such that ACK-only packets are forced from the \nOpenSSL implementation peer (i.e., by sending numerous PING frames),\nand then withholding any subsequent acks for ack-eliciting data, like\nlegitimate data, said malicious peer can force inappropriate memory growth\non the OpenSSL peer, potentially leading to a Denial of Service.\n\nThe fix is to ensure that we account for the transmission of the ACK-only\npacket in the packet histories high and low watermark without actually storing\nthe ACK-only packet metadata itself.\n\nFIPS impact: no\nThe OpenSSL FIPS module is not affected as the QUIC code is\noutside the FIPS module boundary."
}
],
"metrics": [
{
"format": "other",
"other": {
"content": {
"text": "Low"
},
"type": "https://openssl-library.org/policies/general/security-policy/"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T13:00:04.752Z",
"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"shortName": "openssl"
},
"references": [
{
"name": "OpenSSL Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://openssl-library.org/news/secadv/20260825.txt"
},
{
"name": "4.0.2 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/7308946576b12e64b8be53bcf0a120354b2b42bc"
},
{
"name": "3.6.4 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/bf84721c2548351176e367e6de505792f0118dc6"
},
{
"name": "3.5.8 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/7c98d79738549df92868e7dd9be4bbf061eed709"
},
{
"name": "3.4.7 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/c902e5f16d6a9e130e96d3ca6d8f64d71652e393"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "QUIC ACK-only Packet Retention Can Cause Memory Exhaustion",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"assignerShortName": "openssl",
"cveId": "CVE-2026-63075",
"datePublished": "2026-08-25T13:00:04.752Z",
"dateReserved": "2026-07-15T13:10:26.188Z",
"dateUpdated": "2026-08-25T14:36:51.928Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63076 (GCVE-0-2026-63076)
Vulnerability from cvelistv5 – Published: 2026-08-25 13:00 – Updated: 2026-08-25 14:37
VLAI
EPSS
VEX
Title
Invalid Pointer Dereference in CMP Server via Crafted protectionAlg
Summary
Issue summary: OpenSSL CMP password based protection verification only
checks whether the protectionAlg parameter was not NULL and not its
ASN.1 type, before treating it as a PBMParameter. A crafted message can
contain a parameter of a different type, which is then dereferenced as an
invalid pointer.
Impact summary: A remote, unauthenticated attacker can crash an application
acting as a CMP server that accepts PBM-protected messages, or a CMP client
talking to a malicious or intercepted CMP server, resulting in a Denial of
Service.
CWE: CWE-476: NULL Pointer Dereference
Description: When verifying the password-based MAC protection of a CMP
message, OpenSSL library reads the protectionAlg algorithm parameter with
X509_ALGOR_get0(), which returns both the parameter type and its value
pointer. The value is then cast to an ASN1_STRING and treated as the
expected PBMParameter after only checking that pointer is not NULL. The
parameter type returned by X509_ALGOR_get0() was never consulted.
This happens during protection verification, before any MAC is computed, so
no knowledge of the PBM shared secret is required; the only precondition is
that PBM verification is reachable. On the server side this is reached from
OSSL_CMP_SRV_process_request() for any application that stands up a CMP
server accepting PBM-protected messages, and on the client side from CMP
response validation against a malicious or on-path (MITM) server. The
reliable consequence is a denial of service; there is no memory disclosure,
no controlled memory write, and no path to code execution. CMP is a
specialized feature that an application must explicitly enable.
FIPS impact: no
As the CMP code lives outside the FIPS module boundary, no FIPS modules
are affected by this CVE.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 14:37 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
6 references
Impacted products
Date Public
2026-08-25 11:36
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-63076",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T14:37:28.943884Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T14:37:32.193Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenSSL",
"vendor": "OpenSSL",
"versions": [
{
"lessThan": "4.0.2",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"lessThan": "3.6.4",
"status": "affected",
"version": "3.6.0",
"versionType": "semver"
},
{
"lessThan": "3.5.8",
"status": "affected",
"version": "3.5.0",
"versionType": "semver"
},
{
"lessThan": "3.4.7",
"status": "affected",
"version": "3.4.0",
"versionType": "semver"
},
{
"lessThan": "3.0.22",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ying Dong"
},
{
"lang": "en",
"type": "reporter",
"value": "Bhabani Sankar Das"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Daniel Kubec"
}
],
"datePublic": "2026-08-25T11:36:16.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Issue summary: OpenSSL CMP password based protection verification only\u003cbr\u003echecks whether the protectionAlg parameter was not NULL and not its\u003cbr\u003eASN.1 type, before treating it as a PBMParameter. A crafted message can\u003cbr\u003econtain a parameter of a different type, which is then dereferenced as an\u003cbr\u003einvalid pointer.\u003cbr\u003e\u003cbr\u003eImpact summary: A remote, unauthenticated attacker can crash an application\u003cbr\u003eacting as a CMP server that accepts PBM-protected messages, or a CMP client\u003cbr\u003etalking to a malicious or intercepted CMP server, resulting in a Denial of\u003cbr\u003eService.\u003cbr\u003e\u003cbr\u003eCWE: CWE-476: NULL Pointer Dereference\u003cbr\u003e\u003cbr\u003eDescription: When verifying the password-based MAC protection of a CMP\u003cbr\u003emessage, OpenSSL library reads the protectionAlg algorithm parameter with\u003cbr\u003eX509_ALGOR_get0(), which returns both the parameter type and its value\u003cbr\u003epointer. The value is then cast to an ASN1_STRING and treated as the\u003cbr\u003eexpected PBMParameter after only checking that pointer is not NULL. The\u003cbr\u003eparameter type returned by X509_ALGOR_get0() was never consulted.\u003cbr\u003e\u003cbr\u003eThis happens during protection verification, before any MAC is computed, so\u003cbr\u003eno knowledge of the PBM shared secret is required; the only precondition is\u003cbr\u003ethat PBM verification is reachable. On the server side this is reached from\u003cbr\u003eOSSL_CMP_SRV_process_request() for any application that stands up a CMP\u003cbr\u003eserver accepting PBM-protected messages, and on the client side from CMP\u003cbr\u003eresponse validation against a malicious or on-path (MITM) server. The\u003cbr\u003ereliable consequence is a denial of service; there is no memory disclosure,\u003cbr\u003eno controlled memory write, and no path to code execution. CMP is a\u003cbr\u003especialized feature that an application must explicitly enable.\u003cbr\u003e\u003cbr\u003eFIPS impact: no\u003cbr\u003eAs the CMP code lives outside the FIPS module boundary, no FIPS modules\u003cbr\u003eare affected by this CVE."
}
],
"value": "Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."
}
],
"metrics": [
{
"format": "other",
"other": {
"content": {
"text": "Moderate"
},
"type": "https://openssl-library.org/policies/general/security-policy/"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T13:00:11.218Z",
"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"shortName": "openssl"
},
"references": [
{
"name": "OpenSSL Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://openssl-library.org/news/secadv/20260825.txt"
},
{
"name": "4.0.2 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e"
},
{
"name": "3.6.4 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226"
},
{
"name": "3.5.8 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c"
},
{
"name": "3.4.7 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259"
},
{
"name": "3.0.22 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"assignerShortName": "openssl",
"cveId": "CVE-2026-63076",
"datePublished": "2026-08-25T13:00:11.218Z",
"dateReserved": "2026-07-15T13:10:26.188Z",
"dateUpdated": "2026-08-25T14:37:32.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6429 (GCVE-0-2026-6429)
Vulnerability from cvelistv5 – Published: 2026-05-13 08:28 – Updated: 2026-09-15 06:03
VLAI
EPSS
VEX
Title
netrc credential leak with reused proxy connection
Summary
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, libcurl could leak the password used for the first host to the
followed-to host under certain circumstances.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-13 14:03 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| curl | curl |
Affected:
7.14.0 , < 8.14.2
(semver)
Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.0 (semver) |
|
| curl | curl |
Affected:
01165e08e0d131b399fba2190f17af67e66f0888 , < b4024bf808bd558026fdc6096e8457f199ace306
(git)
|
|
| curl | curl |
Affected:
8.19.0
Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0 Affected: 7.57.0 Affected: 7.56.1 Affected: 7.56.0 Affected: 7.55.1 Affected: 7.55.0 Affected: 7.54.1 Affected: 7.54.0 Affected: 7.53.1 Affected: 7.53.0 Affected: 7.52.1 Affected: 7.52.0 Affected: 7.51.0 Affected: 7.50.3 Affected: 7.50.2 Affected: 7.50.1 Affected: 7.50.0 Affected: 7.49.1 Affected: 7.49.0 Affected: 7.48.0 Affected: 7.47.1 Affected: 7.47.0 Affected: 7.46.0 Affected: 7.45.0 Affected: 7.44.0 Affected: 7.43.0 Affected: 7.42.1 Affected: 7.42.0 Affected: 7.41.0 Affected: 7.40.0 Affected: 7.39.0 Affected: 7.38.0 Affected: 7.37.1 Affected: 7.37.0 Affected: 7.36.0 Affected: 7.35.0 Affected: 7.34.0 Affected: 7.33.0 Affected: 7.32.0 Affected: 7.31.0 Affected: 7.30.0 Affected: 7.29.0 Affected: 7.28.1 Affected: 7.28.0 Affected: 7.27.0 Affected: 7.26.0 Affected: 7.25.0 Affected: 7.24.0 Affected: 7.23.1 Affected: 7.23.0 Affected: 7.22.0 Affected: 7.21.7 Affected: 7.21.6 Affected: 7.21.5 Affected: 7.21.4 Affected: 7.21.3 Affected: 7.21.2 Affected: 7.21.1 Affected: 7.21.0 Affected: 7.20.1 Affected: 7.20.0 Affected: 7.19.7 Affected: 7.19.6 Affected: 7.19.5 Affected: 7.19.4 Affected: 7.19.3 Affected: 7.19.2 Affected: 7.19.1 Affected: 7.19.0 Affected: 7.18.2 Affected: 7.18.1 Affected: 7.18.0 Affected: 7.17.1 Affected: 7.17.0 Affected: 7.16.4 Affected: 7.16.3 Affected: 7.16.2 Affected: 7.16.1 Affected: 7.16.0 Affected: 7.15.5 Affected: 7.15.4 Affected: 7.15.3 Affected: 7.15.2 Affected: 7.15.1 Affected: 7.15.0 Affected: 7.14.1 Affected: 7.14.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-6429",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T14:03:52.312824Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T14:03:55.343Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "curl",
"vendor": "curl",
"versions": [
{
"lessThan": "8.14.2",
"status": "affected",
"version": "7.14.0",
"versionType": "semver"
},
{
"lessThan": "8.16.1",
"status": "affected",
"version": "8.15.0",
"versionType": "semver"
},
{
"lessThan": "8.20.0",
"status": "affected",
"version": "8.17.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "curl",
"repo": "https://github.com/curl/curl.git",
"vendor": "curl",
"versions": [
{
"lessThan": "b4024bf808bd558026fdc6096e8457f199ace306",
"status": "affected",
"version": "01165e08e0d131b399fba2190f17af67e66f0888",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "curl",
"vendor": "curl",
"versions": [
{
"status": "affected",
"version": "8.19.0"
},
{
"status": "affected",
"version": "8.18.0"
},
{
"status": "affected",
"version": "8.17.0"
},
{
"status": "affected",
"version": "8.16.0"
},
{
"status": "affected",
"version": "8.15.0"
},
{
"status": "affected",
"version": "8.14.1"
},
{
"status": "affected",
"version": "8.14.0"
},
{
"status": "affected",
"version": "8.13.0"
},
{
"status": "affected",
"version": "8.12.1"
},
{
"status": "affected",
"version": "8.12.0"
},
{
"status": "affected",
"version": "8.11.1"
},
{
"status": "affected",
"version": "8.11.0"
},
{
"status": "affected",
"version": "8.10.1"
},
{
"status": "affected",
"version": "8.10.0"
},
{
"status": "affected",
"version": "8.9.1"
},
{
"status": "affected",
"version": "8.9.0"
},
{
"status": "affected",
"version": "8.8.0"
},
{
"status": "affected",
"version": "8.7.1"
},
{
"status": "affected",
"version": "8.7.0"
},
{
"status": "affected",
"version": "8.6.0"
},
{
"status": "affected",
"version": "8.5.0"
},
{
"status": "affected",
"version": "8.4.0"
},
{
"status": "affected",
"version": "8.3.0"
},
{
"status": "affected",
"version": "8.2.1"
},
{
"status": "affected",
"version": "8.2.0"
},
{
"status": "affected",
"version": "8.1.2"
},
{
"status": "affected",
"version": "8.1.1"
},
{
"status": "affected",
"version": "8.1.0"
},
{
"status": "affected",
"version": "8.0.1"
},
{
"status": "affected",
"version": "8.0.0"
},
{
"status": "affected",
"version": "7.88.1"
},
{
"status": "affected",
"version": "7.88.0"
},
{
"status": "affected",
"version": "7.87.0"
},
{
"status": "affected",
"version": "7.86.0"
},
{
"status": "affected",
"version": "7.85.0"
},
{
"status": "affected",
"version": "7.84.0"
},
{
"status": "affected",
"version": "7.83.1"
},
{
"status": "affected",
"version": "7.83.0"
},
{
"status": "affected",
"version": "7.82.0"
},
{
"status": "affected",
"version": "7.81.0"
},
{
"status": "affected",
"version": "7.80.0"
},
{
"status": "affected",
"version": "7.79.1"
},
{
"status": "affected",
"version": "7.79.0"
},
{
"status": "affected",
"version": "7.78.0"
},
{
"status": "affected",
"version": "7.77.0"
},
{
"status": "affected",
"version": "7.76.1"
},
{
"status": "affected",
"version": "7.76.0"
},
{
"status": "affected",
"version": "7.75.0"
},
{
"status": "affected",
"version": "7.74.0"
},
{
"status": "affected",
"version": "7.73.0"
},
{
"status": "affected",
"version": "7.72.0"
},
{
"status": "affected",
"version": "7.71.1"
},
{
"status": "affected",
"version": "7.71.0"
},
{
"status": "affected",
"version": "7.70.0"
},
{
"status": "affected",
"version": "7.69.1"
},
{
"status": "affected",
"version": "7.69.0"
},
{
"status": "affected",
"version": "7.68.0"
},
{
"status": "affected",
"version": "7.67.0"
},
{
"status": "affected",
"version": "7.66.0"
},
{
"status": "affected",
"version": "7.65.3"
},
{
"status": "affected",
"version": "7.65.2"
},
{
"status": "affected",
"version": "7.65.1"
},
{
"status": "affected",
"version": "7.65.0"
},
{
"status": "affected",
"version": "7.64.1"
},
{
"status": "affected",
"version": "7.64.0"
},
{
"status": "affected",
"version": "7.63.0"
},
{
"status": "affected",
"version": "7.62.0"
},
{
"status": "affected",
"version": "7.61.1"
},
{
"status": "affected",
"version": "7.61.0"
},
{
"status": "affected",
"version": "7.60.0"
},
{
"status": "affected",
"version": "7.59.0"
},
{
"status": "affected",
"version": "7.58.0"
},
{
"status": "affected",
"version": "7.57.0"
},
{
"status": "affected",
"version": "7.56.1"
},
{
"status": "affected",
"version": "7.56.0"
},
{
"status": "affected",
"version": "7.55.1"
},
{
"status": "affected",
"version": "7.55.0"
},
{
"status": "affected",
"version": "7.54.1"
},
{
"status": "affected",
"version": "7.54.0"
},
{
"status": "affected",
"version": "7.53.1"
},
{
"status": "affected",
"version": "7.53.0"
},
{
"status": "affected",
"version": "7.52.1"
},
{
"status": "affected",
"version": "7.52.0"
},
{
"status": "affected",
"version": "7.51.0"
},
{
"status": "affected",
"version": "7.50.3"
},
{
"status": "affected",
"version": "7.50.2"
},
{
"status": "affected",
"version": "7.50.1"
},
{
"status": "affected",
"version": "7.50.0"
},
{
"status": "affected",
"version": "7.49.1"
},
{
"status": "affected",
"version": "7.49.0"
},
{
"status": "affected",
"version": "7.48.0"
},
{
"status": "affected",
"version": "7.47.1"
},
{
"status": "affected",
"version": "7.47.0"
},
{
"status": "affected",
"version": "7.46.0"
},
{
"status": "affected",
"version": "7.45.0"
},
{
"status": "affected",
"version": "7.44.0"
},
{
"status": "affected",
"version": "7.43.0"
},
{
"status": "affected",
"version": "7.42.1"
},
{
"status": "affected",
"version": "7.42.0"
},
{
"status": "affected",
"version": "7.41.0"
},
{
"status": "affected",
"version": "7.40.0"
},
{
"status": "affected",
"version": "7.39.0"
},
{
"status": "affected",
"version": "7.38.0"
},
{
"status": "affected",
"version": "7.37.1"
},
{
"status": "affected",
"version": "7.37.0"
},
{
"status": "affected",
"version": "7.36.0"
},
{
"status": "affected",
"version": "7.35.0"
},
{
"status": "affected",
"version": "7.34.0"
},
{
"status": "affected",
"version": "7.33.0"
},
{
"status": "affected",
"version": "7.32.0"
},
{
"status": "affected",
"version": "7.31.0"
},
{
"status": "affected",
"version": "7.30.0"
},
{
"status": "affected",
"version": "7.29.0"
},
{
"status": "affected",
"version": "7.28.1"
},
{
"status": "affected",
"version": "7.28.0"
},
{
"status": "affected",
"version": "7.27.0"
},
{
"status": "affected",
"version": "7.26.0"
},
{
"status": "affected",
"version": "7.25.0"
},
{
"status": "affected",
"version": "7.24.0"
},
{
"status": "affected",
"version": "7.23.1"
},
{
"status": "affected",
"version": "7.23.0"
},
{
"status": "affected",
"version": "7.22.0"
},
{
"status": "affected",
"version": "7.21.7"
},
{
"status": "affected",
"version": "7.21.6"
},
{
"status": "affected",
"version": "7.21.5"
},
{
"status": "affected",
"version": "7.21.4"
},
{
"status": "affected",
"version": "7.21.3"
},
{
"status": "affected",
"version": "7.21.2"
},
{
"status": "affected",
"version": "7.21.1"
},
{
"status": "affected",
"version": "7.21.0"
},
{
"status": "affected",
"version": "7.20.1"
},
{
"status": "affected",
"version": "7.20.0"
},
{
"status": "affected",
"version": "7.19.7"
},
{
"status": "affected",
"version": "7.19.6"
},
{
"status": "affected",
"version": "7.19.5"
},
{
"status": "affected",
"version": "7.19.4"
},
{
"status": "affected",
"version": "7.19.3"
},
{
"status": "affected",
"version": "7.19.2"
},
{
"status": "affected",
"version": "7.19.1"
},
{
"status": "affected",
"version": "7.19.0"
},
{
"status": "affected",
"version": "7.18.2"
},
{
"status": "affected",
"version": "7.18.1"
},
{
"status": "affected",
"version": "7.18.0"
},
{
"status": "affected",
"version": "7.17.1"
},
{
"status": "affected",
"version": "7.17.0"
},
{
"status": "affected",
"version": "7.16.4"
},
{
"status": "affected",
"version": "7.16.3"
},
{
"status": "affected",
"version": "7.16.2"
},
{
"status": "affected",
"version": "7.16.1"
},
{
"status": "affected",
"version": "7.16.0"
},
{
"status": "affected",
"version": "7.15.5"
},
{
"status": "affected",
"version": "7.15.4"
},
{
"status": "affected",
"version": "7.15.3"
},
{
"status": "affected",
"version": "7.15.2"
},
{
"status": "affected",
"version": "7.15.1"
},
{
"status": "affected",
"version": "7.15.0"
},
{
"status": "affected",
"version": "7.14.1"
},
{
"status": "affected",
"version": "7.14.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muhamad Arga Reksapati"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Daniel Stenberg"
}
],
"descriptions": [
{
"lang": "en",
"value": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T06:03:05.855Z",
"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"shortName": "curl"
},
"references": [
{
"url": "https://curl.se/docs/CVE-2026-6429.json"
},
{
"url": "https://curl.se/docs/CVE-2026-6429.html"
},
{
"url": "https://hackerone.com/reports/3677759"
}
],
"title": "netrc credential leak with reused proxy connection",
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_osv": {
"affected": [
{
"ranges": [
{
"events": [
{
"introduced": "7.14.0"
},
{
"fixed": "8.14.2"
},
{
"introduced": "8.15.0"
},
{
"fixed": "8.16.1"
},
{
"introduced": "8.17.0"
},
{
"fixed": "8.20.0"
}
],
"type": "SEMVER"
},
{
"events": [
{
"introduced": "01165e08e0d131b399fba2190f17af67e66f0888"
},
{
"fixed": "b4024bf808bd558026fdc6096e8457f199ace306"
}
],
"repo": "https://github.com/curl/curl.git",
"type": "GIT"
}
],
"versions": [
"8.19.0",
"8.18.0",
"8.17.0",
"8.16.0",
"8.15.0",
"8.14.1",
"8.14.0",
"8.13.0",
"8.12.1",
"8.12.0",
"8.11.1",
"8.11.0",
"8.10.1",
"8.10.0",
"8.9.1",
"8.9.0",
"8.8.0",
"8.7.1",
"8.7.0",
"8.6.0",
"8.5.0",
"8.4.0",
"8.3.0",
"8.2.1",
"8.2.0",
"8.1.2",
"8.1.1",
"8.1.0",
"8.0.1",
"8.0.0",
"7.88.1",
"7.88.0",
"7.87.0",
"7.86.0",
"7.85.0",
"7.84.0",
"7.83.1",
"7.83.0",
"7.82.0",
"7.81.0",
"7.80.0",
"7.79.1",
"7.79.0",
"7.78.0",
"7.77.0",
"7.76.1",
"7.76.0",
"7.75.0",
"7.74.0",
"7.73.0",
"7.72.0",
"7.71.1",
"7.71.0",
"7.70.0",
"7.69.1",
"7.69.0",
"7.68.0",
"7.67.0",
"7.66.0",
"7.65.3",
"7.65.2",
"7.65.1",
"7.65.0",
"7.64.1",
"7.64.0",
"7.63.0",
"7.62.0",
"7.61.1",
"7.61.0",
"7.60.0",
"7.59.0",
"7.58.0",
"7.57.0",
"7.56.1",
"7.56.0",
"7.55.1",
"7.55.0",
"7.54.1",
"7.54.0",
"7.53.1",
"7.53.0",
"7.52.1",
"7.52.0",
"7.51.0",
"7.50.3",
"7.50.2",
"7.50.1",
"7.50.0",
"7.49.1",
"7.49.0",
"7.48.0",
"7.47.1",
"7.47.0",
"7.46.0",
"7.45.0",
"7.44.0",
"7.43.0",
"7.42.1",
"7.42.0",
"7.41.0",
"7.40.0",
"7.39.0",
"7.38.0",
"7.37.1",
"7.37.0",
"7.36.0",
"7.35.0",
"7.34.0",
"7.33.0",
"7.32.0",
"7.31.0",
"7.30.0",
"7.29.0",
"7.28.1",
"7.28.0",
"7.27.0",
"7.26.0",
"7.25.0",
"7.24.0",
"7.23.1",
"7.23.0",
"7.22.0",
"7.21.7",
"7.21.6",
"7.21.5",
"7.21.4",
"7.21.3",
"7.21.2",
"7.21.1",
"7.21.0",
"7.20.1",
"7.20.0",
"7.19.7",
"7.19.6",
"7.19.5",
"7.19.4",
"7.19.3",
"7.19.2",
"7.19.1",
"7.19.0",
"7.18.2",
"7.18.1",
"7.18.0",
"7.17.1",
"7.17.0",
"7.16.4",
"7.16.3",
"7.16.2",
"7.16.1",
"7.16.0",
"7.15.5",
"7.15.4",
"7.15.3",
"7.15.2",
"7.15.1",
"7.15.0",
"7.14.1",
"7.14.0"
]
}
],
"aliases": [
"CVE-2026-6429"
],
"credits": [
{
"name": "Muhamad Arga Reksapati",
"type": "finder"
},
{
"name": "Daniel Stenberg",
"type": "remediation developer"
}
],
"database_specific": {
"CWE": {
"desc": "Exposure of Sensitive Information to an Unauthorized Actor",
"id": "CWE-200"
},
"URL": "https://curl.se/docs/CVE-2026-6429.json",
"affects": "lib",
"issue": "https://hackerone.com/reports/3677759",
"last_affected": "8.19.0",
"package": "curl",
"severity": "Medium",
"www": "https://curl.se/docs/CVE-2026-6429.html"
},
"details": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.",
"id": "CURL-CVE-2026-6429",
"modified": "2026-09-07T10:34:51.00Z",
"published": "2026-04-29T08:00:00.00Z",
"schema_version": "1.5.0",
"summary": "netrc credential leak with reused proxy connection"
}
}
},
"cveMetadata": {
"assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"assignerShortName": "curl",
"cveId": "CVE-2026-6429",
"datePublished": "2026-05-13T08:28:36.166Z",
"dateReserved": "2026-04-16T14:48:02.991Z",
"dateUpdated": "2026-09-15T06:03:05.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66046 (GCVE-0-2026-66046)
Vulnerability from cvelistv5 – Published: 2026-08-18 14:10 – Updated: 2026-10-01 15:20 X_Open Source
VLAI
EPSS
VEX
Title
Expat Denial of Service via storeAtts() Quadratic Complexity
Summary
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:48 UTC
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/libexpat/libexpat/pull/1321 | issue-tracking |
| https://www.vulncheck.com/advisories/expat-denial… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| libexpat project | libexpat |
Affected:
0 , ≤ 2.8.3
(semver)
cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* |
Date Public
2026-08-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66046",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:48:24.577412Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:24:17.474Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"packageURL": "pkg:github/libexpat/libexpat",
"product": "libexpat",
"repo": "https://github.com/libexpat/libexpat",
"vendor": "libexpat project",
"versions": [
{
"lessThanOrEqual": "2.8.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.8.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Fabian Wahle (Hap Security)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Sebastian Pipping"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulnCheck"
}
],
"datePublic": "2026-08-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType-\u003edefaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T15:20:15.522Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request",
"tags": [
"issue-tracking"
],
"url": "https://github.com/libexpat/libexpat/pull/1321"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Expat Denial of Service via storeAtts() Quadratic Complexity",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-66046",
"datePublished": "2026-08-18T14:10:05.176Z",
"dateReserved": "2026-07-23T20:45:17.817Z",
"dateUpdated": "2026-10-01T15:20:15.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6732 (GCVE-0-2026-6732)
Vulnerability from cvelistv5 – Published: 2026-04-23 22:19 – Updated: 2026-08-31 11:15
VLAI
EPSS
VEX
Title
Libxml2: libxml2: denial of service via crafted xsd-validated document
Summary
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-24 10:53 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:11503 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/security/cve/CVE-2026-6732 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2461300 | issue-trackingx_refsource_REDHAT |
| https://gitlab.gnome.org/GNOME/libxml2/-/issues/1097 | |
| https://gitlab.gnome.org/GNOME/libxml2/-/merge_re… |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Hardened Images |
Unaffected:
2.15.3-0.1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat JBoss Core Services |
cpe:/a:redhat:jboss_core_services:1
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4
|
Date Public
2026-04-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6732",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-24T10:53:00.163293Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T10:54:21.129Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "libxml2-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "2.15.3-0.1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "libxml2",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "libxml2",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "libxml2",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "libxml2",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "libxml2",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"cpes": [
"cpe:/a:redhat:jboss_core_services:1"
],
"defaultStatus": "affected",
"packageName": "libxml2",
"product": "Red Hat JBoss Core Services",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "openshift/ose-rhel-coreos-8",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "openshift/ose-rhel-coreos-9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Ariel Schon for reporting this issue."
}
],
"datePublic": "2026-04-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T11:15:35.301Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:11503",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11503"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-6732"
},
{
"name": "RHBZ#2461300",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461300"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1097"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/411"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-23T22:04:33.973Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-16T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Libxml2: libxml2: denial of service via crafted xsd-validated document",
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-6732",
"datePublished": "2026-04-23T22:19:34.322Z",
"dateReserved": "2026-04-20T22:34:45.863Z",
"dateUpdated": "2026-08-31T11:15:35.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7009 (GCVE-0-2026-7009)
Vulnerability from cvelistv5 – Published: 2026-05-13 08:28 – Updated: 2026-05-13 14:20
VLAI
EPSS
VEX
Title
OCSP stapling bypass with Apple SecTrust
Summary
When curl is told to use the Certificate Status Request TLS extension, often
referred to as *OCSP stapling*, to verify that the server certificate is
valid, it fails to detect OCSP problems and instead wrongly consider the
response as fine.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-13 14:20 UTC
Assigner
References
Impacted products
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-05-13T09:05:48.665Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/29/12"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-7009",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T14:20:11.436717Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T14:20:33.908Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackerone.com/reports/3694390"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "curl",
"vendor": "curl",
"versions": [
{
"lessThanOrEqual": "8.19.0",
"status": "affected",
"version": "8.19.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.18.0",
"status": "affected",
"version": "8.18.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.17.0",
"status": "affected",
"version": "8.17.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Carlos Carrillo"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Stefan Eissing"
}
],
"descriptions": [
{
"lang": "en",
"value": "When curl is told to use the Certificate Status Request TLS extension, often\nreferred to as *OCSP stapling*, to verify that the server certificate is\nvalid, it fails to detect OCSP problems and instead wrongly consider the\nresponse as fine."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-295 Improper Certificate Validation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T08:28:53.697Z",
"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"shortName": "curl"
},
"references": [
{
"name": "json",
"url": "https://curl.se/docs/CVE-2026-7009.json"
},
{
"name": "www",
"url": "https://curl.se/docs/CVE-2026-7009.html"
},
{
"name": "issue",
"url": "https://hackerone.com/reports/3694390"
}
],
"title": "OCSP stapling bypass with Apple SecTrust"
}
},
"cveMetadata": {
"assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"assignerShortName": "curl",
"cveId": "CVE-2026-7009",
"datePublished": "2026-05-13T08:28:53.697Z",
"dateReserved": "2026-04-25T08:37:24.989Z",
"dateUpdated": "2026-05-13T14:20:33.908Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7168 (GCVE-0-2026-7168)
Vulnerability from cvelistv5 – Published: 2026-05-13 08:29 – Updated: 2026-09-15 06:03
VLAI
EPSS
VEX
Title
cross-proxy Digest auth state leak
Summary
Successfully using libcurl to do a transfer over a specific HTTP proxy
(`proxyA`) with **Digest** authentication and then changing the proxy host to
a second one (`proxyB`) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the `Proxy-Authorization:` header field meant for
`proxyA`, to `proxyB`.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-13 14:18 UTC
CWE
- CWE-294 - Authentication Bypass by Capture-replay
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| curl | curl |
Affected:
7.12.0 , < 8.14.2
(semver)
Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.0 (semver) |
|
| curl | curl |
Affected:
fc6eff13b5414caf6edf22d73a3239e074a04216 , < c1cfdf59acbaf9504c4578d4cf56cdd7c8594507
(git)
|
|
| curl | curl |
Affected:
8.19.0
Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0 Affected: 7.57.0 Affected: 7.56.1 Affected: 7.56.0 Affected: 7.55.1 Affected: 7.55.0 Affected: 7.54.1 Affected: 7.54.0 Affected: 7.53.1 Affected: 7.53.0 Affected: 7.52.1 Affected: 7.52.0 Affected: 7.51.0 Affected: 7.50.3 Affected: 7.50.2 Affected: 7.50.1 Affected: 7.50.0 Affected: 7.49.1 Affected: 7.49.0 Affected: 7.48.0 Affected: 7.47.1 Affected: 7.47.0 Affected: 7.46.0 Affected: 7.45.0 Affected: 7.44.0 Affected: 7.43.0 Affected: 7.42.1 Affected: 7.42.0 Affected: 7.41.0 Affected: 7.40.0 Affected: 7.39.0 Affected: 7.38.0 Affected: 7.37.1 Affected: 7.37.0 Affected: 7.36.0 Affected: 7.35.0 Affected: 7.34.0 Affected: 7.33.0 Affected: 7.32.0 Affected: 7.31.0 Affected: 7.30.0 Affected: 7.29.0 Affected: 7.28.1 Affected: 7.28.0 Affected: 7.27.0 Affected: 7.26.0 Affected: 7.25.0 Affected: 7.24.0 Affected: 7.23.1 Affected: 7.23.0 Affected: 7.22.0 Affected: 7.21.7 Affected: 7.21.6 Affected: 7.21.5 Affected: 7.21.4 Affected: 7.21.3 Affected: 7.21.2 Affected: 7.21.1 Affected: 7.21.0 Affected: 7.20.1 Affected: 7.20.0 Affected: 7.19.7 Affected: 7.19.6 Affected: 7.19.5 Affected: 7.19.4 Affected: 7.19.3 Affected: 7.19.2 Affected: 7.19.1 Affected: 7.19.0 Affected: 7.18.2 Affected: 7.18.1 Affected: 7.18.0 Affected: 7.17.1 Affected: 7.17.0 Affected: 7.16.4 Affected: 7.16.3 Affected: 7.16.2 Affected: 7.16.1 Affected: 7.16.0 Affected: 7.15.5 Affected: 7.15.4 Affected: 7.15.3 Affected: 7.15.2 Affected: 7.15.1 Affected: 7.15.0 Affected: 7.14.1 Affected: 7.14.0 Affected: 7.13.2 Affected: 7.13.1 Affected: 7.13.0 Affected: 7.12.3 Affected: 7.12.2 Affected: 7.12.1 Affected: 7.12.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-05-13T09:05:54.907Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/29/14"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-7168",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T14:18:10.734219Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T16:12:24.400Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackerone.com/reports/3697719"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "curl",
"vendor": "curl",
"versions": [
{
"lessThan": "8.14.2",
"status": "affected",
"version": "7.12.0",
"versionType": "semver"
},
{
"lessThan": "8.16.1",
"status": "affected",
"version": "8.15.0",
"versionType": "semver"
},
{
"lessThan": "8.20.0",
"status": "affected",
"version": "8.17.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "curl",
"repo": "https://github.com/curl/curl.git",
"vendor": "curl",
"versions": [
{
"lessThan": "c1cfdf59acbaf9504c4578d4cf56cdd7c8594507",
"status": "affected",
"version": "fc6eff13b5414caf6edf22d73a3239e074a04216",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "curl",
"vendor": "curl",
"versions": [
{
"status": "affected",
"version": "8.19.0"
},
{
"status": "affected",
"version": "8.18.0"
},
{
"status": "affected",
"version": "8.17.0"
},
{
"status": "affected",
"version": "8.16.0"
},
{
"status": "affected",
"version": "8.15.0"
},
{
"status": "affected",
"version": "8.14.1"
},
{
"status": "affected",
"version": "8.14.0"
},
{
"status": "affected",
"version": "8.13.0"
},
{
"status": "affected",
"version": "8.12.1"
},
{
"status": "affected",
"version": "8.12.0"
},
{
"status": "affected",
"version": "8.11.1"
},
{
"status": "affected",
"version": "8.11.0"
},
{
"status": "affected",
"version": "8.10.1"
},
{
"status": "affected",
"version": "8.10.0"
},
{
"status": "affected",
"version": "8.9.1"
},
{
"status": "affected",
"version": "8.9.0"
},
{
"status": "affected",
"version": "8.8.0"
},
{
"status": "affected",
"version": "8.7.1"
},
{
"status": "affected",
"version": "8.7.0"
},
{
"status": "affected",
"version": "8.6.0"
},
{
"status": "affected",
"version": "8.5.0"
},
{
"status": "affected",
"version": "8.4.0"
},
{
"status": "affected",
"version": "8.3.0"
},
{
"status": "affected",
"version": "8.2.1"
},
{
"status": "affected",
"version": "8.2.0"
},
{
"status": "affected",
"version": "8.1.2"
},
{
"status": "affected",
"version": "8.1.1"
},
{
"status": "affected",
"version": "8.1.0"
},
{
"status": "affected",
"version": "8.0.1"
},
{
"status": "affected",
"version": "8.0.0"
},
{
"status": "affected",
"version": "7.88.1"
},
{
"status": "affected",
"version": "7.88.0"
},
{
"status": "affected",
"version": "7.87.0"
},
{
"status": "affected",
"version": "7.86.0"
},
{
"status": "affected",
"version": "7.85.0"
},
{
"status": "affected",
"version": "7.84.0"
},
{
"status": "affected",
"version": "7.83.1"
},
{
"status": "affected",
"version": "7.83.0"
},
{
"status": "affected",
"version": "7.82.0"
},
{
"status": "affected",
"version": "7.81.0"
},
{
"status": "affected",
"version": "7.80.0"
},
{
"status": "affected",
"version": "7.79.1"
},
{
"status": "affected",
"version": "7.79.0"
},
{
"status": "affected",
"version": "7.78.0"
},
{
"status": "affected",
"version": "7.77.0"
},
{
"status": "affected",
"version": "7.76.1"
},
{
"status": "affected",
"version": "7.76.0"
},
{
"status": "affected",
"version": "7.75.0"
},
{
"status": "affected",
"version": "7.74.0"
},
{
"status": "affected",
"version": "7.73.0"
},
{
"status": "affected",
"version": "7.72.0"
},
{
"status": "affected",
"version": "7.71.1"
},
{
"status": "affected",
"version": "7.71.0"
},
{
"status": "affected",
"version": "7.70.0"
},
{
"status": "affected",
"version": "7.69.1"
},
{
"status": "affected",
"version": "7.69.0"
},
{
"status": "affected",
"version": "7.68.0"
},
{
"status": "affected",
"version": "7.67.0"
},
{
"status": "affected",
"version": "7.66.0"
},
{
"status": "affected",
"version": "7.65.3"
},
{
"status": "affected",
"version": "7.65.2"
},
{
"status": "affected",
"version": "7.65.1"
},
{
"status": "affected",
"version": "7.65.0"
},
{
"status": "affected",
"version": "7.64.1"
},
{
"status": "affected",
"version": "7.64.0"
},
{
"status": "affected",
"version": "7.63.0"
},
{
"status": "affected",
"version": "7.62.0"
},
{
"status": "affected",
"version": "7.61.1"
},
{
"status": "affected",
"version": "7.61.0"
},
{
"status": "affected",
"version": "7.60.0"
},
{
"status": "affected",
"version": "7.59.0"
},
{
"status": "affected",
"version": "7.58.0"
},
{
"status": "affected",
"version": "7.57.0"
},
{
"status": "affected",
"version": "7.56.1"
},
{
"status": "affected",
"version": "7.56.0"
},
{
"status": "affected",
"version": "7.55.1"
},
{
"status": "affected",
"version": "7.55.0"
},
{
"status": "affected",
"version": "7.54.1"
},
{
"status": "affected",
"version": "7.54.0"
},
{
"status": "affected",
"version": "7.53.1"
},
{
"status": "affected",
"version": "7.53.0"
},
{
"status": "affected",
"version": "7.52.1"
},
{
"status": "affected",
"version": "7.52.0"
},
{
"status": "affected",
"version": "7.51.0"
},
{
"status": "affected",
"version": "7.50.3"
},
{
"status": "affected",
"version": "7.50.2"
},
{
"status": "affected",
"version": "7.50.1"
},
{
"status": "affected",
"version": "7.50.0"
},
{
"status": "affected",
"version": "7.49.1"
},
{
"status": "affected",
"version": "7.49.0"
},
{
"status": "affected",
"version": "7.48.0"
},
{
"status": "affected",
"version": "7.47.1"
},
{
"status": "affected",
"version": "7.47.0"
},
{
"status": "affected",
"version": "7.46.0"
},
{
"status": "affected",
"version": "7.45.0"
},
{
"status": "affected",
"version": "7.44.0"
},
{
"status": "affected",
"version": "7.43.0"
},
{
"status": "affected",
"version": "7.42.1"
},
{
"status": "affected",
"version": "7.42.0"
},
{
"status": "affected",
"version": "7.41.0"
},
{
"status": "affected",
"version": "7.40.0"
},
{
"status": "affected",
"version": "7.39.0"
},
{
"status": "affected",
"version": "7.38.0"
},
{
"status": "affected",
"version": "7.37.1"
},
{
"status": "affected",
"version": "7.37.0"
},
{
"status": "affected",
"version": "7.36.0"
},
{
"status": "affected",
"version": "7.35.0"
},
{
"status": "affected",
"version": "7.34.0"
},
{
"status": "affected",
"version": "7.33.0"
},
{
"status": "affected",
"version": "7.32.0"
},
{
"status": "affected",
"version": "7.31.0"
},
{
"status": "affected",
"version": "7.30.0"
},
{
"status": "affected",
"version": "7.29.0"
},
{
"status": "affected",
"version": "7.28.1"
},
{
"status": "affected",
"version": "7.28.0"
},
{
"status": "affected",
"version": "7.27.0"
},
{
"status": "affected",
"version": "7.26.0"
},
{
"status": "affected",
"version": "7.25.0"
},
{
"status": "affected",
"version": "7.24.0"
},
{
"status": "affected",
"version": "7.23.1"
},
{
"status": "affected",
"version": "7.23.0"
},
{
"status": "affected",
"version": "7.22.0"
},
{
"status": "affected",
"version": "7.21.7"
},
{
"status": "affected",
"version": "7.21.6"
},
{
"status": "affected",
"version": "7.21.5"
},
{
"status": "affected",
"version": "7.21.4"
},
{
"status": "affected",
"version": "7.21.3"
},
{
"status": "affected",
"version": "7.21.2"
},
{
"status": "affected",
"version": "7.21.1"
},
{
"status": "affected",
"version": "7.21.0"
},
{
"status": "affected",
"version": "7.20.1"
},
{
"status": "affected",
"version": "7.20.0"
},
{
"status": "affected",
"version": "7.19.7"
},
{
"status": "affected",
"version": "7.19.6"
},
{
"status": "affected",
"version": "7.19.5"
},
{
"status": "affected",
"version": "7.19.4"
},
{
"status": "affected",
"version": "7.19.3"
},
{
"status": "affected",
"version": "7.19.2"
},
{
"status": "affected",
"version": "7.19.1"
},
{
"status": "affected",
"version": "7.19.0"
},
{
"status": "affected",
"version": "7.18.2"
},
{
"status": "affected",
"version": "7.18.1"
},
{
"status": "affected",
"version": "7.18.0"
},
{
"status": "affected",
"version": "7.17.1"
},
{
"status": "affected",
"version": "7.17.0"
},
{
"status": "affected",
"version": "7.16.4"
},
{
"status": "affected",
"version": "7.16.3"
},
{
"status": "affected",
"version": "7.16.2"
},
{
"status": "affected",
"version": "7.16.1"
},
{
"status": "affected",
"version": "7.16.0"
},
{
"status": "affected",
"version": "7.15.5"
},
{
"status": "affected",
"version": "7.15.4"
},
{
"status": "affected",
"version": "7.15.3"
},
{
"status": "affected",
"version": "7.15.2"
},
{
"status": "affected",
"version": "7.15.1"
},
{
"status": "affected",
"version": "7.15.0"
},
{
"status": "affected",
"version": "7.14.1"
},
{
"status": "affected",
"version": "7.14.0"
},
{
"status": "affected",
"version": "7.13.2"
},
{
"status": "affected",
"version": "7.13.1"
},
{
"status": "affected",
"version": "7.13.0"
},
{
"status": "affected",
"version": "7.12.3"
},
{
"status": "affected",
"version": "7.12.2"
},
{
"status": "affected",
"version": "7.12.1"
},
{
"status": "affected",
"version": "7.12.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muhamad Arga Reksapati"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Daniel Stenberg"
}
],
"descriptions": [
{
"lang": "en",
"value": "Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T06:03:07.424Z",
"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"shortName": "curl"
},
"references": [
{
"url": "https://curl.se/docs/CVE-2026-7168.json"
},
{
"url": "https://curl.se/docs/CVE-2026-7168.html"
},
{
"url": "https://hackerone.com/reports/3697719"
}
],
"title": "cross-proxy Digest auth state leak",
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_osv": {
"affected": [
{
"ranges": [
{
"events": [
{
"introduced": "7.12.0"
},
{
"fixed": "8.14.2"
},
{
"introduced": "8.15.0"
},
{
"fixed": "8.16.1"
},
{
"introduced": "8.17.0"
},
{
"fixed": "8.20.0"
}
],
"type": "SEMVER"
},
{
"events": [
{
"introduced": "fc6eff13b5414caf6edf22d73a3239e074a04216"
},
{
"fixed": "c1cfdf59acbaf9504c4578d4cf56cdd7c8594507"
}
],
"repo": "https://github.com/curl/curl.git",
"type": "GIT"
}
],
"versions": [
"8.19.0",
"8.18.0",
"8.17.0",
"8.16.0",
"8.15.0",
"8.14.1",
"8.14.0",
"8.13.0",
"8.12.1",
"8.12.0",
"8.11.1",
"8.11.0",
"8.10.1",
"8.10.0",
"8.9.1",
"8.9.0",
"8.8.0",
"8.7.1",
"8.7.0",
"8.6.0",
"8.5.0",
"8.4.0",
"8.3.0",
"8.2.1",
"8.2.0",
"8.1.2",
"8.1.1",
"8.1.0",
"8.0.1",
"8.0.0",
"7.88.1",
"7.88.0",
"7.87.0",
"7.86.0",
"7.85.0",
"7.84.0",
"7.83.1",
"7.83.0",
"7.82.0",
"7.81.0",
"7.80.0",
"7.79.1",
"7.79.0",
"7.78.0",
"7.77.0",
"7.76.1",
"7.76.0",
"7.75.0",
"7.74.0",
"7.73.0",
"7.72.0",
"7.71.1",
"7.71.0",
"7.70.0",
"7.69.1",
"7.69.0",
"7.68.0",
"7.67.0",
"7.66.0",
"7.65.3",
"7.65.2",
"7.65.1",
"7.65.0",
"7.64.1",
"7.64.0",
"7.63.0",
"7.62.0",
"7.61.1",
"7.61.0",
"7.60.0",
"7.59.0",
"7.58.0",
"7.57.0",
"7.56.1",
"7.56.0",
"7.55.1",
"7.55.0",
"7.54.1",
"7.54.0",
"7.53.1",
"7.53.0",
"7.52.1",
"7.52.0",
"7.51.0",
"7.50.3",
"7.50.2",
"7.50.1",
"7.50.0",
"7.49.1",
"7.49.0",
"7.48.0",
"7.47.1",
"7.47.0",
"7.46.0",
"7.45.0",
"7.44.0",
"7.43.0",
"7.42.1",
"7.42.0",
"7.41.0",
"7.40.0",
"7.39.0",
"7.38.0",
"7.37.1",
"7.37.0",
"7.36.0",
"7.35.0",
"7.34.0",
"7.33.0",
"7.32.0",
"7.31.0",
"7.30.0",
"7.29.0",
"7.28.1",
"7.28.0",
"7.27.0",
"7.26.0",
"7.25.0",
"7.24.0",
"7.23.1",
"7.23.0",
"7.22.0",
"7.21.7",
"7.21.6",
"7.21.5",
"7.21.4",
"7.21.3",
"7.21.2",
"7.21.1",
"7.21.0",
"7.20.1",
"7.20.0",
"7.19.7",
"7.19.6",
"7.19.5",
"7.19.4",
"7.19.3",
"7.19.2",
"7.19.1",
"7.19.0",
"7.18.2",
"7.18.1",
"7.18.0",
"7.17.1",
"7.17.0",
"7.16.4",
"7.16.3",
"7.16.2",
"7.16.1",
"7.16.0",
"7.15.5",
"7.15.4",
"7.15.3",
"7.15.2",
"7.15.1",
"7.15.0",
"7.14.1",
"7.14.0",
"7.13.2",
"7.13.1",
"7.13.0",
"7.12.3",
"7.12.2",
"7.12.1",
"7.12.0"
]
}
],
"aliases": [
"CVE-2026-7168"
],
"credits": [
{
"name": "Muhamad Arga Reksapati",
"type": "finder"
},
{
"name": "Daniel Stenberg",
"type": "remediation developer"
}
],
"database_specific": {
"CWE": {
"desc": "Authentication Bypass by Capture-replay",
"id": "CWE-294"
},
"URL": "https://curl.se/docs/CVE-2026-7168.json",
"affects": "lib",
"issue": "https://hackerone.com/reports/3697719",
"last_affected": "8.19.0",
"package": "curl",
"severity": "Medium",
"www": "https://curl.se/docs/CVE-2026-7168.html"
},
"details": "Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.",
"id": "CURL-CVE-2026-7168",
"modified": "2026-09-07T10:34:51.00Z",
"published": "2026-04-29T08:00:00.00Z",
"schema_version": "1.5.0",
"summary": "cross-proxy Digest auth state leak"
}
}
},
"cveMetadata": {
"assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"assignerShortName": "curl",
"cveId": "CVE-2026-7168",
"datePublished": "2026-05-13T08:29:08.900Z",
"dateReserved": "2026-04-27T07:37:37.172Z",
"dateUpdated": "2026-09-15T06:03:07.424Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72897 (GCVE-0-2026-72897)
Vulnerability from cvelistv5 – Published: 2026-09-29 15:32 – Updated: 2026-09-29 17:16
VLAI
EPSS
VEX
Title
Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake
Summary
Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a
connection to a different SSL_CTX part way through a handshake may access
memory beyond the end of an internal array if the replacement context knows
about more provider signature algorithms than the context the connection was
created from. Applications which never call SSL_set_SSL_CTX() are not
affected.
Impact summary: A remote peer may be able to cause a small out-of-bounds
read, and in some circumstances a fixed-value out-of-bounds write, on the
server heap. This may lead to a Denial of Service.
CWE: CWE-787: Out-of-bounds Write
Description: A TLS connection records how many certificate slots it has
when it is created, taken from the SSL_CTX that created it: the built-in
certificate types plus one slot for each provider TLS-SIGALG entry that
context was aware of. That count sizes an internal array of per-slot
certificate validity flags.
An application may replace a connection's SSL_CTX part way through the
handshake by calling SSL_set_SSL_CTX(), most commonly from a servername
callback in order to serve a different virtual host. Doing so did not
refresh the recorded count. A provider signature algorithm's slot index is
its position in the list of whichever context resolves it, so if the
replacement context is aware of more of them than the original, an
algorithm offered by the peer can resolve to an index beyond the end of the
array. Processing the peer's signature algorithms then reads one four byte
word past the end for each such algorithm and, where the word read is zero,
writes a fixed value over it. A peer offering many of them can corrupt heap
metadata and abort the process.
Only provider signature algorithms which occupy one of the excess slots,
and which the server also has configured, have this effect. Codepoints the
replacement context does not recognise are discarded without being resolved
to a slot, and provider signature algorithms are usable only from TLS 1.3.
The two contexts must therefore be aware of different numbers of provider
signature algorithms, which requires separate library contexts, a provider
loaded between the two being created, or providers which differ in what
they advertise - in 4.0, for example, the default provider advertises SM2
where the FIPS provider does not. A deployment meeting the condition is
also unable to negotiate the affected algorithms with legitimate clients,
since the same stale count hides the corresponding certificates, so the
misconfiguration is likely to be noticed. For that reason, and because the
configuration is not the default, this issue has been assessed as Low
severity.
FIPS impact: no
No FIPS modules are affected by this issue as the affected code is outside
the OpenSSL FIPS module boundary.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 17:16 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
5 references
Impacted products
Date Public
2026-09-29 14:21
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-72897",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T17:16:29.979390Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T17:16:38.842Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenSSL",
"vendor": "OpenSSL",
"versions": [
{
"lessThan": "4.0.3",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"lessThan": "3.6.5",
"status": "affected",
"version": "3.6.0",
"versionType": "semver"
},
{
"lessThan": "3.5.9",
"status": "affected",
"version": "3.5.0",
"versionType": "semver"
},
{
"lessThan": "3.4.8",
"status": "affected",
"version": "3.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Filipe Casal (Trail of Bits)"
},
{
"lang": "en",
"type": "reporter",
"value": "Brandon Luo"
},
{
"lang": "en",
"type": "reporter",
"value": "Luigino Camastra (Aisle Research)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Matt Caswell"
}
],
"datePublic": "2026-09-29T14:21:57.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a\u003cbr\u003econnection to a different SSL_CTX part way through a handshake may access\u003cbr\u003ememory beyond the end of an internal array if the replacement context knows\u003cbr\u003eabout more provider signature algorithms than the context the connection was\u003cbr\u003ecreated from. Applications which never call SSL_set_SSL_CTX() are not\u003cbr\u003eaffected.\u003cbr\u003e\u003cbr\u003eImpact summary: A remote peer may be able to cause a small out-of-bounds\u003cbr\u003eread, and in some circumstances a fixed-value out-of-bounds write, on the\u003cbr\u003eserver heap. This may lead to a Denial of Service.\u003cbr\u003e\u003cbr\u003eCWE: CWE-787: Out-of-bounds Write\u003cbr\u003e\u003cbr\u003eDescription: A TLS connection records how many certificate slots it has\u003cbr\u003ewhen it is created, taken from the SSL_CTX that created it: the built-in\u003cbr\u003ecertificate types plus one slot for each provider TLS-SIGALG entry that\u003cbr\u003econtext was aware of. That count sizes an internal array of per-slot\u003cbr\u003ecertificate validity flags.\u003cbr\u003e\u003cbr\u003eAn application may replace a connection\u0027s SSL_CTX part way through the\u003cbr\u003ehandshake by calling SSL_set_SSL_CTX(), most commonly from a servername\u003cbr\u003ecallback in order to serve a different virtual host. Doing so did not\u003cbr\u003erefresh the recorded count. A provider signature algorithm\u0027s slot index is\u003cbr\u003eits position in the list of whichever context resolves it, so if the\u003cbr\u003ereplacement context is aware of more of them than the original, an\u003cbr\u003ealgorithm offered by the peer can resolve to an index beyond the end of the\u003cbr\u003earray. Processing the peer\u0027s signature algorithms then reads one four byte\u003cbr\u003eword past the end for each such algorithm and, where the word read is zero,\u003cbr\u003ewrites a fixed value over it. A peer offering many of them can corrupt heap\u003cbr\u003emetadata and abort the process.\u003cbr\u003e\u003cbr\u003eOnly provider signature algorithms which occupy one of the excess slots,\u003cbr\u003eand which the server also has configured, have this effect. Codepoints the\u003cbr\u003ereplacement context does not recognise are discarded without being resolved\u003cbr\u003eto a slot, and provider signature algorithms are usable only from TLS 1.3.\u003cbr\u003e\u003cbr\u003eThe two contexts must therefore be aware of different numbers of provider\u003cbr\u003esignature algorithms, which requires separate library contexts, a provider\u003cbr\u003eloaded between the two being created, or providers which differ in what\u003cbr\u003ethey advertise - in 4.0, for example, the default provider advertises SM2\u003cbr\u003ewhere the FIPS provider does not. A deployment meeting the condition is\u003cbr\u003ealso unable to negotiate the affected algorithms with legitimate clients,\u003cbr\u003esince the same stale count hides the corresponding certificates, so the\u003cbr\u003emisconfiguration is likely to be noticed. For that reason, and because the\u003cbr\u003econfiguration is not the default, this issue has been assessed as Low\u003cbr\u003eseverity.\u003cbr\u003e\u003cbr\u003eFIPS impact: no\u003cbr\u003eNo FIPS modules are affected by this issue as the affected code is outside\u003cbr\u003ethe OpenSSL FIPS module boundary."
}
],
"value": "Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a\nconnection to a different SSL_CTX part way through a handshake may access\nmemory beyond the end of an internal array if the replacement context knows\nabout more provider signature algorithms than the context the connection was\ncreated from. Applications which never call SSL_set_SSL_CTX() are not\naffected.\n\nImpact summary: A remote peer may be able to cause a small out-of-bounds\nread, and in some circumstances a fixed-value out-of-bounds write, on the\nserver heap. This may lead to a Denial of Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: A TLS connection records how many certificate slots it has\nwhen it is created, taken from the SSL_CTX that created it: the built-in\ncertificate types plus one slot for each provider TLS-SIGALG entry that\ncontext was aware of. That count sizes an internal array of per-slot\ncertificate validity flags.\n\nAn application may replace a connection\u0027s SSL_CTX part way through the\nhandshake by calling SSL_set_SSL_CTX(), most commonly from a servername\ncallback in order to serve a different virtual host. Doing so did not\nrefresh the recorded count. A provider signature algorithm\u0027s slot index is\nits position in the list of whichever context resolves it, so if the\nreplacement context is aware of more of them than the original, an\nalgorithm offered by the peer can resolve to an index beyond the end of the\narray. Processing the peer\u0027s signature algorithms then reads one four byte\nword past the end for each such algorithm and, where the word read is zero,\nwrites a fixed value over it. A peer offering many of them can corrupt heap\nmetadata and abort the process.\n\nOnly provider signature algorithms which occupy one of the excess slots,\nand which the server also has configured, have this effect. Codepoints the\nreplacement context does not recognise are discarded without being resolved\nto a slot, and provider signature algorithms are usable only from TLS 1.3.\n\nThe two contexts must therefore be aware of different numbers of provider\nsignature algorithms, which requires separate library contexts, a provider\nloaded between the two being created, or providers which differ in what\nthey advertise - in 4.0, for example, the default provider advertises SM2\nwhere the FIPS provider does not. A deployment meeting the condition is\nalso unable to negotiate the affected algorithms with legitimate clients,\nsince the same stale count hides the corresponding certificates, so the\nmisconfiguration is likely to be noticed. For that reason, and because the\nconfiguration is not the default, this issue has been assessed as Low\nseverity.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."
}
],
"metrics": [
{
"format": "other",
"other": {
"content": {
"text": "Low"
},
"type": "https://openssl-library.org/policies/general/security-policy/"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T15:32:18.277Z",
"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"shortName": "openssl"
},
"references": [
{
"name": "OpenSSL Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://openssl-library.org/news/secadv/20260929.txt"
},
{
"name": "4.0.3 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/e87ed26b298a74d8ba61a53e9c7bcd1acac6b814"
},
{
"name": "3.6.5 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/9c54d209486f6b1ad79fe2179c40f13200fa4f61"
},
{
"name": "3.5.9 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/4135f553c9d3ba4a09fe752f5d30af2a6a092b2e"
},
{
"name": "3.4.8 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/00646e5085a0d12d29e0d2f9b9bc5f7111a50922"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"assignerShortName": "openssl",
"cveId": "CVE-2026-72897",
"datePublished": "2026-09-29T15:32:18.277Z",
"dateReserved": "2026-08-10T17:02:46.613Z",
"dateUpdated": "2026-09-29T17:16:38.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…