CVE-2026-91769

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

EulerOS 2.0 SP15 : gnutls (EulerOS-SA-2026-3780)

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform...

EulerOS 2.0 SP15 : gnutls (EulerOS-SA-2026-3805)

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform...

CVE-2026-59638

A flaw was found in Bouncy Castle for Java. The Java Secure Socket Extension JSSE hostname verifier incorrectly enables the Common Name CN fallback by default, despite it being documented as an opt-in feature. This misconfiguration could allow a remote attacker to bypass proper hostname validatio...

EulerOS 2.0 SP15 : gnutls (EulerOS-SA-2026-2925)

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically f...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in the HostnameUtil class, whose "match CN when no dNSName SAN exists" fallback is gated on Properties.isOverrideSetJSSEHOSTNAMECHECKCNFALLBACK, true, which returns true when the...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in the HostnameUtil class, whose "match CN when no dNSName SAN exists" fallback is gated on Properties.isOverrideSetJSSEHOSTNAMECHECKCNFALLBACK, true, which returns true when the...

CVE-2026-59638

In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24...

UBUNTU-CVE-2026-59638

In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24...

CVE-2026-59638 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in

In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24...

CVE-2026-59638 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in

In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24...

CVE-2026-59638

In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24...

CVE-2026-59638

In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24...

CVE-2026-59638

In BCJava prior to 1.85 (and BC-LTS before 2.73.12; BC-FJA before bctls-fips 1.0.24/2.0.24/2.1.24), the JSSE hostname verifier CN-fallback is enabled by default despite documented opt-in. This may allow hostname verification to be skipped in TLS, with CVSS v4.0 base score 9.3 (CRITICAL) and impac...

CVE-2026-59638 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in

In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24...

EUVD-2026-52016

In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24...

Linux Distros Unpatched Vulnerability : CVE-2026-59638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle fo...

CVE-2026-59638: Improper Validation of Certificate with Host Mismatch

In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24...

Oracle Linux 9 : gnutls (ELSA-2026-20612)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-20612 advisory. - Fix CVE-2026-33846 DTLS fragment reassembly, High, heap overwrite - Fix CVE-2026-42009 DTLS fragment reassembly, High, undefined behaviour - Fix...

gnutls security update

3.8.10-4 - Fix CVE-2026-33846 DTLS fragment reassembly, High, heap overwrite - Fix CVE-2026-42009 DTLS fragment reassembly, High, undefined behaviour - Fix CVE-2026-33845 DTLS fragment reassembly, High, heap overread - Fix CVE-2026-42010 PSK authentication, High, authentication bypass - Fix...