CVE-2026-55953

Summary: CVE-2026-55953 affects Erlang/OTP SSL/TLS client when using TLS 1.2 and DTLS. The client fails to verify that the server-chosen cipher suite in ServerHello was among the suites offered in ClientHello. An on-path attacker can respond with a ServerHello using an anonymous cipher suite (e.g...

EUVD-2026-49323

The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...

CVE-2026-55953

The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...

CVE-2026-56820

A flaw was found in Netty. The OcspClient component fails to validate that the Certificate ID in an Online Certificate Status Protocol OCSP response matches the requested Certificate ID. This vulnerability allows a remote attacker to bypass certificate revocation checks by presenting a legitimate...

CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

CVE-2026-58227

CVE-2026-58227 : In Erlang/OTP, the ssl certificate chain reconstruction during TLS/DTLS handshakes can fail to detect cycles, causing unbounded recursion when peers supply cross-signed chains (A→B and B→A). The missing cycle detection and depth limit in ssl_certificate:build_certificate_chain/5 ...

CVE-2026-58227

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

EUVD-2026-49315

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

EEF-CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

Summary The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl\certificate:handle\incomplete\chain/5, the received chain is passed to ssl\certificate:build\certificate\chain/5, which walks issuer...

CVE-2026-66053

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603...

CVE-2026-57916

proCertum SmartSign opens Certificate Practice Statement CPS URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local executable file or any URL, sign a document with it, and send it to the victim. When the victim opens the document in the...

CVE-2026-48144

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-48145

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

RLSA-2026:46397 Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network VPN...

libreswan security update

An update is available for libreswan. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the...

CVE-2026-66053

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603...

CVE-2026-66053

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603...

CVE-2026-66053

Technical details are not publicly available in the provided documents. Monitor for updates from official advisories to learn affected versions, exploitability, and remediation.

CVE-2026-66053 Apache Thrift: Python TSSLSocket Hostname Matcher Import

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603...