sslcaudit

简介 sslcaudit 项目的目标是开发一个工具，用于自动化测试 SSL/TLS 客户端对 MITM（中间人）攻击的抵抗能力。它可能有助于测试胖客户端、移动应用、设备，以及几乎所有通过 TCP 上的 SSL/TLS 进行通信的内容。 安装 目前还没有正式的安装流程（Debian 软件包和基于 distutils 的 Python 安装程序即将推出）。现在只需从 GIT 仓库获取发布版本： root@kitploit: $ git clone -b release10 https://github.com/grwl/sslcaudit.git Cloning into...

CVE-2026-0073-Android-ADBD-bypass-POC

CVE-2026-0073 — Android ADBD TLS 认证绕过 EVPPKEYcmp 类型混淆 → 未授权 ADB shell 🔥 概述 Android ADB 守护进程（adbd）中存在一个严重认证绕过 漏洞，允许本地网络上的任何攻击者在未经用户授权 的情况下获取目标设备的完整 shell 。 该漏洞存在于 daemon/auth.cpp 中的 adbdtlsverifycert 函数内，其中 EVPPKEYcmp 被当作布尔值使用。当存储的密钥为 RSA 且提交的 TLS 客户端证书携带非 RSA 密钥 （EC P-256 或 Ed25519）时，EVPPKEYcmp 返...

CVE-2022-21449

CVE-2022-21449 用于检测针对 TLS 客户端的 CVE-2022-21449 利用尝试的 Zeek 脚本。仅适用于 TLS 1.2 及以下版本。 安装 zkg install https://github.com/thack1/CVE-2022-21449 运行 对提供的 pcap 文件运行： $ zeek -Cr pcaps/CVE-2022-21449.pcap CVE-2022-21449 示例通知 root@kitploit: separator \x09 setseparator , emptyfield empty unsetfield - path notic...

EUVD-2026-67934

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...

PT-2026-83361

Name of the Vulnerable Software and Affected Versions mongosqld affected versions not specified Description When configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one. This allows clients that provide no...

RustTLSX

RustTLSX 🦀 . Ein fortschrittlicher Stealth-HTTP-Client für Rust. Entwickelt für datenschutzbewusste Entwickler, die volle Kontrolle über ihren Netzwerk-Fingerprint benötigen. Sieht aus wie ein Browser. Verhält sich wie ein Browser. Geschrieben in Rust. Credits & Grundlage Basiert...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime through the checkcertocspresp function in crypto/x509/x509vfy.c. An attacker can exhaust memory in a TLS client by supplying a stapled OCSP BasicResponse with no single-response entries...

CVE-2026-54876

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim clien...

EUVD-2026-53385

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim clien...

CVE-2026-54876 Client-Side Memory Leak in OCSP Response Checking

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim clien...

CVE-2026-54876

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim clien...

Linux Distros Unpatched Vulnerability : CVE-2026-54876

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains ...

EUVD-2026-49323

The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...

erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing

A flaw was found in Erlang OTP publickey. This improper certificate validation vulnerability allows a subordinate Certificate Authority CA with restricted DNS nameConstraints to bypass these restrictions. By issuing a leaf certificate that lacks a Subject Alternative Name SAN but contains a craft...

CVE-2026-45416

A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS Transport Layer Security ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service DoS due to excessive memor...

Double Free

Overview Affected versions of this package are vulnerable to Double Free in the certificate verification path, in the TLS client's OCSP stapling response handling. An attacker operating a malicious server can deliver an OCSP response via the statusrequest extension that corrupts heap memory and...

CVE-2026-35188

CVE-2026-35188 describes a vulnerability in TLS OCSP stapling where a crafted stapled response delivered via the status_request extension can trigger a double-free in the TLS client’s certificate verification path. Impact: potential heap corruption, with the practical consequence of Denial of Ser...

TencentOS Server 4: storm (TSSA-2026:0414)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0414 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

SUSE CVE-2026-42791

Improper Certificate Validation vulnerability in Erlang OTP publickey pubkeyocsp module allows forged OCSP responses signed with an expired responder certificate to be accepted as valid. OCSP response verification in pubkeyocsp:verifyresponse/5 and pubkeyocsp:isauthorizedresponder/3 in...

CVE-2026-42791 OCSP responder certificate validity period not checked in public_key

Improper Certificate Validation vulnerability in Erlang OTP publickey pubkeyocsp module allows forged OCSP responses signed with an expired responder certificate to be accepted as valid. OCSP response verification in pubkeyocsp:verifyresponse/5 and pubkeyocsp:isauthorizedresponder/3 in...