39 matches found
Security Bulletin: IBM QRadar SIEM contains weak private keys issued by the eMudhra certificate authority
Summary The certificate authority CA store used in IBM QRadar SIEM included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue...
CVE-2026-118780
The Forge (also known as node-forge ) JavaScript TLS implementation is vulnerable to a persistent availability impact in versions prior to 1.4.1 . The root cause is that the pki.verifyCertificateChain() and pki.createCaStore() functions improperly handle duplicate subject names . Specifically, th...
CVE-2026-118780 Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain, pki.createCaStore, duplicate subject names to process the relevant input or security decision. node-forge modified the CA...
CVE-2026-118780: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain, pki.createCaStore, duplicate subject names to process the relevant input or security decision. node-forge modified the CA...
OESA-2026-4124 curl security update
cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...
Authentication Bypass by Primary Weakness
Overview Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the connection reuse process when a different Native CA Store setting is used than the one originally configured. An attacker can compromise the integrity of HTTPS connections by exploiting t...
CVE-2026-80231
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
AZL-99831 CVE-2026-80231 affecting package rust 1.75.0-30
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
AZL-99774 CVE-2026-80231 affecting package cmake 3.30.3-15
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
AZL-99807 CVE-2026-80231 affecting package mysql 8.0.46-1
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
AZL-99855 CVE-2026-80231 affecting package rust 1.90.0-10
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
AZL-99758 CVE-2026-80231 affecting package curl 8.11.1-11
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
ALPINE-CVE-2026-80231
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
AZL-99876 CVE-2026-80231 affecting package tensorflow 2.16.1-11
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
CVE-2026-80231 native CA store conn reuse
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
CVE-2026-80231 native CA store conn reuse
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
EUVD-2026-72169
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
CVE-2026-80231 native CA store conn reuse
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
CVE-2026-80231
A vulnerability in libcurl allows the library to incorrectly reuse an existing HTTPS connection for a given hostname when there is a mismatch in the Native CA Store setting (CURLSSLOPT_NATIVE_CA) compared to the initial connection. Additionally, research indicates a related issue where a TLS sess...
CVE-2026-80231
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...