75 matches found
cve-2009-3555-test-server
What is this? This is a TLS server using a vendored fork of the Go TLS stack that has renegotation indication extension forcibly disabled, which will trigger CVE-2009-3555 mitigations in OpenSSL 3.0+. Note that it isn't truly vulnerable to CVE-2009-3555 because the Go TLS stack doesn't allow...
CVE-2026-59993
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a client-side TLS stack, a peer can send a HelloRetryRequest followed by a spoofed Hello message that causes a null-pointer...
CVE-2026-59993 Picotls has NULL pointer dereference during handshake, when running as a client
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a client-side TLS stack, a peer can send a HelloRetryRequest followed by a spoofed Hello message that causes a null-pointer...
EUVD-2026-114509
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a client-side TLS stack, a peer can send a HelloRetryRequest followed by a spoofed Hello message that causes a null-pointer...
CVE-2026-59993
The Picotls TLS protocol library is vulnerable to a null-pointer dereference in revisions through 44bc503 when utilized as a client-side TLS stack . An attacker can trigger this by sending a HelloRetryRequest followed by a spoofed Hello message , which can terminate the consuming process and resu...
CVE-2026-59993 Picotls has NULL pointer dereference during handshake, when running as a client
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a client-side TLS stack, a peer can send a HelloRetryRequest followed by a spoofed Hello message that causes a null-pointer...
CVE-2026-59993: h2o picotls: Picotls is a TLS protocol library that allows users select different crypto backends based on their use case
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a client-side TLS stack, a peer can send a HelloRetryRequest followed by a spoofed Hello message that causes a null-pointer...
PT-2026-134218
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a client-side TLS stack, a peer can send a HelloRetryRequest followed by a spoofed Hello message that causes a null-pointer...
nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames
A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence...
nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames
A flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause checkServerIdentity to accept a certificate that does not...
nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames
A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence...
nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames
A flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause checkServerIdentity to accept a certificate that does not...
golang-fips: Golang FIPS zeroed buffer
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...
golang-fips: Golang FIPS zeroed buffer
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...
nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames
A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence...
Improper Check for Certificate Revocation
Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the Node.js TLS stack in the main and utility processes, whic...
Improper Check for Certificate Revocation
Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the Node.js TLS stack in the main and utility processes, which lacked an...
CVE-2026-106069
A flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause checkServerIdentity to accept a certificate that does not...
CVE-2026-105483
A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence...
nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames
A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence...