CVE-2026-100551 OpenClaw iOS Control UI TLS Pin Enforcement Bypass

OpenClaw for iOS versions = 2026.7.1 and 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an...

CVE-2026-100551 OpenClaw iOS Control UI TLS Pin Enforcement Bypass

OpenClaw for iOS versions = 2026.7.1 and 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an...

EUVD-2026-87499

OpenClaw for iOS versions = 2026.7.1 and 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an...

CVE-2026-100551

OpenClaw for iOS versions >= 2026.7.1 and

FreeBSD : RusTLS FFI -- plaintext TLS handshake vulnerability (ff969b25-b97b-11f1-b09d-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ff969b25-b97b-11f1-b09d-8447094a420f advisory. The RusTLS project reports: TLS 1.3 handshake message processing could allow a broken peer to send...

PT-2026-99188

Name of the Vulnerable Software and Affected Versions OpenClaw for iOS versions 2026.7.1 through 2026.8.10 Description The Control UI fails to enforce saved Gateway TLS pins. While native connections maintain the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews...

CVE-2026-100701: Improper Certificate Validation

Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports secure: true resolve the same non-IP host with different tls.servername values, t...

RusTLS FFI -- plaintext TLS handshake vulnerability

The RusTLS project reports: TLS 1.3 handshake message processing could allow a broken peer to send plaintext handshake messages where an encrypted one is expected without rustls rejecting the connection...

DEBIAN-CVE-2026-91767

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

CVE-2026-91767

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

AZL-104922 CVE-2026-91767 affecting package php 8.3.33-1

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

UBUNTU-CVE-2026-91767

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

CVE-2026-91767

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

CVE-2026-91767

A flaw was found in PHP. When validating secure connections using Transport Layer Security TLS, an error in how wildcard domain names in server certificates are verified can lead to an out-of-bounds memory read. A malicious server presenting a specially crafted certificate can exploit this issue...

CVE-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

CVE-2026-91767

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

CVE-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

EUVD-2026-87343

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

CVE-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

CVE-2026-91767

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...