75 matches found
CVE-2026-33896
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, pki.verifyCertificateChain does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the basicConstraints and keyUsage extensions...
UBUNTU-CVE-2026-33896
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, pki.verifyCertificateChain does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the basicConstraints and keyUsage extensions...
CVE-2026-33896
Technical details are not publicly available in the provided documents; no affected products, versions, or remediation are specified. Monitor for updates to confirm scope and fixes.
CVE-2026-33896 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, pki.verifyCertificateChain does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the basicConstraints and keyUsage extensions...
Digital Bazaar Forge Trust Management Vulnerability
Digital Bazaar Forge is a native implementation of TLS in JavaScript by the American company Digital Bazaar, and it is an open-source tool used for developing encrypted and network-intensive web applications. Versions of Digital Bazaar Forge prior to 1.4.0 had a trust management vulnerability. Th...
Improper Certificate Validation
Overview org.webjars.npm:node-forge is a WebJar for node-forge. Affected versions of this package are vulnerable to Improper Certificate Validation in the verifyCertificateChain function. An attacker can gain unauthorized certificate authority capabilities by presenting a certificate chain where ...
GHSA-2328-F5F3-GJ25 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
Summary pki.verifyCertificateChain does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the basicConstraints and keyUsage extensions. This allows any leaf certificate without these extensions to act as a CA and sign other certificates, which node-for...
Failed to perform post-processing for plug-in. Error: The issuer certificate does not have a Basic Constraints extension.
Challenge After upgrading a Windows-based Veeam Backup & Replication deployment to version 13.0.1 or higher, the following error may occur: Failed to perform post-processing for plug-in $pluginName Linux $machine Error: The issuer certificate does not have a Basic Constraints extension. Examples:...
HSEC-2023-0005 tls-extra: certificate validation does not check Basic Constraints
tls-extra: certificate validation does not check Basic Constraints tls-extra does not check the Basic Constraints extension of a certificate in certificate chain processing. Any certificate is treated as a CA certificate. As a consequence, anyone who has a valid certificate can use it to sign...
EUVD-2013-0275
Malware in sbrugna...
CVE-2013-0243
haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections...
CVE-2023-49570 Insecure Trust of Basic Constraints certificate in Bitdefender Total Security HTTPS Scanning (VA-11210)
A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that isn't authorized to issue certificates. This occurs when the "Basic Constraints" extension in the certificate indicates that it is meant ...
CVE-2023-49570: Improper Certificate Validation
A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that isn't authorized to issue certificates. This occurs when the "Basic Constraints" extension in the certificate indicates that it is meant ...
K16937: OpenSSL vulnerability CVE-2015-1793
Security Advisory Description Description The X509verifycert function in crypto/x509/x509vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints CA values during identification of alternative certificate chains, which allows remote attackers to spoof ...
SUSE CVE-2014-3694
The 1 bundled GnuTLS SSL/TLS plugin and the 2 bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and...
SUSE CVE-2015-1793
The X509verifycert function in crypto/x509/x509vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger...
PT-2020-22048
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read error. The crash state indicates involvement of the x509 parse ext basic constraints, x509 parse...
PT-2020-22043
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap buffer overflow read issue is identified, potentially causing a crash. The crash occurs in the asn1 get next function, which is called by x509 parse...
PT-2020-7185
Name of the Vulnerable Software and Affected Versions Cisco IronPort Web Security Appliance versions up to and including 7.5 Description The issue concerns the failure to validate the basic constraints of the certificate authority, which could lead to man-in-the-middle MITM attacks. Recommendatio...
