CVE-2026-100665

Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint...

mkchain

mkchain Open source tool to help you build a valid SSL certificate chain. Description • How To Use • Parameters • How it works • Requirements • Other • License Description Is an open source tool to help you build a valid SSL certificate chain. Also can help you fix the incomplete chain and downlo...

CVE-2022-3602

CVE‑2022‑3602 これは何ですか？ このドキュメントとリポジトリは、OpenSSLにおけるpunycodeバッファオーバーフローの問題であるCVE‑2022‑3602の解説です。これは「アンチPoC」であり（この問題は悪用可能ではないように見えます）、独自にOpenSSLをビルドしている方やコンパイラメンテナ向けの内容です。...

python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

A flaw was found in python-cryptography. When processing invalid certificate chains that include duplicate self-signed certificates, the system recursively invokes the same certificate, leading to an exponential increase in processing time. A remote attacker could exploit this by providing a...

python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

A flaw was found in python-cryptography. When processing invalid certificate chains that include duplicate self-signed certificates, the system recursively invokes the same certificate, leading to an exponential increase in processing time. A remote attacker could exploit this by providing a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124495)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124495 advisory. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124491)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124491 advisory. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124496)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124496 advisory. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124464)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124464 advisory. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain...

CVE-2026-0257

使用 TLS 的公钥伪造 GlobalProtect 身份验证覆盖 Cookie CVE-2026-0257 一个概念验证脚本，用于测试目标 PAN-OS GlobalProtect 门户或网关是否存在 CVE-2026-0257。该脚本会遍历 HTTPS 服务使用的证书链，并针对链中的每个公钥伪造一个有效的身份验证覆盖 Cookie，然后对 GlobalProtect 目标进行测试，验证其是否有效。 成功伪造的 Cookie 将登录 GlobalProtect 目标并检索 VPN 连接信息（使用 --verbose 参数查看详细信息）。 使用方法 root@kitploit: $...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

Astra Linux – Vulnerability in Golang 1.19, Golang 1.23

During the chain building process, the amount of work performed is not properly limited when a large number of intermediate certificates are passed in as VerifyOptions intermediates. This can lead to a denial of service. This issue affects both direct users of crypto/x509 and users of crypto/tls...

Astra Linux – Vulnerability in OpenSSL

A security vulnerability has been identified in all supported versions of OpenSSL, related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use o...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...