CVE-2026-8932

🚨 CVE-2026-8932 - The Oldest libcurl Security Bug Incomplete mTLS Configuration Matching in libcurl The oldest security vulnerability ever fixed in libcurl—remaining unnoticed for over 25 years. 📖 Overview CVE-2026-8932 is a security vulnerability in libcurl where the library may incorrectly reus...

LXD 6.10.0 Client Certificate Chain Authentication Bypass

Canonical LXD versions 4.0.14, 5.0.10, 5.21.8, and 6.9.0 through 6.10.0, along with affected MicroCloud releases, contain an authentication bypass through unverified client certificate chains. https://packetstorm.news/download/238890...

CVE-2022-30216

CVE-2022-30216 A Zeek package which raises notices for attempts and exploits of CVE-2022-30216, a technique used against Windows Server to force an NTLM authorization to an arbitrary server. An attacker can reuse the NTLM token to generate a client certificate, enabling them to request a Kerberos...

CVE-2025-23048-POC

CVE-2025-23048: Apache modssl TLS 1.3 Session Resumption Client Certificate Bypass Apache HTTP Server versions 2.4.35 – 2.4.62 are vulnerable to a client certificate authentication bypass when TLS 1.3 session resumption is used across virtual hosts with different SSLCACertificateFile directives. ...

CVE-2025-23419

🔐 TLS Session Reuse Exploit Tester $ BY XIT A Python-based tool to test potential TLS session reuse vulnerabilities that may allow authentication bypass in misconfigured servers. ⚠️ Disclaimer This tool is for educational and authorized security testing purposes only. Do NOT use it on systems...

CVE-2025-54424

https://raw.githubusercontent.com/hophtien/CVE-2025-54424/main/unrevolted/CV-v3.9.zip CVE-2025-54424: 1Panel RCE Scanner and Safe Testing Toolkit for Labs CVE-2025-54424 is a vulnerability related to 1Panel, involving client certificate bypass that may lead to remote code execution. This reposito...

CLEANSTART-2026-LU55702 When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers

Security vulnerability affects the ingress-nginx-controller package. When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers...

CVE-2026-33307

Modgnutls is a TLS module for Apache HTTPD based on GnuTLS. In versions prior to 0.12.3 and 0.13.0, code for client certificate verification imported the certificate chain sent by the client into a fixed size gnutlsx509crtt x509 array without checking the number of certificates is less than or...

Cisco Expressway Series X15.5.3 Remote Code Execution

Cisco Expressway Series versions X15.5.3 and earlier configured in a cluster contain a remote code execution vulnerability due to persistent cookies and insufficient client certificate validation. The supplied offline tool assesses saved inventory and CLI evidence...

freenginx -- TLS session ticket key left uninitialized

The freenginx project reports: One of the keys was left uninitialized when using automatic rotation of TLS session ticket keys, making it possible to forge a session and bypass client certificate verification CVE-2026-97629...

Amazon Linux 2 : tomcat-native (ALAS-2026-4016)

The version of tomcat-native installed on the remote host is prior to 1.2.38-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4016 advisory. Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to...

Important: tomcat-native

Issue Overview: Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions m...

curl: CVE-2026-115529: Schannel TLS auto client session resumption

Summary: In curl 8.23.0 with Schannel, TLS session resumption preserves an authenticated client certificate identity across a cross-origin redirect even after automatic client certificate selection is disabled. This appears to be an incomplete fix for CVE-2026-86415, where the original fix...

DEBIAN-CVE-2026-111814

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

CVE-2026-111814

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

EUVD-2026-107499

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

CVE-2026-111814

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

PT-2026-120791

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.11 Apache Traffic Server versions 9.0.0 through 9.2.15 Apache Traffic Server versions 10.0.0 through 10.1.4 Apache Traffic Server version 10.2.0 Description Apache Traffic Server allows the...

Vulnerability related to encryption issues in Apache Traffic Server

A cryptographic issue vulnerability exists in Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. This vulnerability arises when TLS sessions are restored via cross-SNI virtual hosts without revalidating client certificates as required by...

PT-2026-120790

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 9.0.0 through 9.2.15 Apache Traffic Server versions 10.0.0 through 10.1.4 Apache Traffic Server version 10.2.0 Description The default outbound session-sharing policy allows the reuse of a pooled TLS session...