CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868

Steeltoe (open-source cloud-native application libraries) is vulnerable in Steeltoe.Security.Authorization.Certificate prior to version 4.3.0 . When using AddOrgAndSpacePolicies() and UseCertificateAuthorization(), the framework trusts the public certificate supplied in the X-Client-Cert request ...

EUVD-2026-81899

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

tomcat: Client certificate verification bypass due to virtual host mapping

A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one ...

tomcat: Client certificate verification bypass due to virtual host mapping

A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one ...

tomcat: Client certificate verification bypass due to virtual host mapping

A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one ...

androidx.benchmark:benchmark-common (>=1.2.0-alpha02, <=1.2.0-alpha13), androidx.benchmark:benchmark-junit4 (>=1.2.0-alpha02, <=1.2.0-alpha13) +5 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.4.1)

com.squareup.wire:wire-runtime MAVEN version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - androidx.benchmark:benchmark-common =1.2.0-alpha02, =1.2.0-alpha02, =1.2.0-alpha02, =1.2.0-alpha02,...

com.squareup.wire:wire-grpc-client (4.9.6), com.squareup.wire:wire-schema (4.9.6) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.6)

com.squareup.wire:wire-runtime MAVEN version 4.9.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.6 - com.squareup.wire:wire-schema 4.9.6 -...

com.squareup.wire:wire-grpc-client (4.5.3), com.squareup.wire:wire-schema (4.5.3) potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.5.3)

com.squareup.wire:wire-runtime MAVEN version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.5.3 - com.squareup.wire:wire-schema 4.5.3 Source cves:...

com.squareup.wire:wire-grpc-client (4.6.1), com.squareup.wire:wire-schema (4.6.1) potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.6.1)

com.squareup.wire:wire-runtime MAVEN version 4.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.6.1 - com.squareup.wire:wire-schema 4.6.1 Source cves:...

com.squareup.wire:proto-pruner (3.0.0-rc03), com.squareup.wire:wire-codegen-sample (3.0.0-rc03) +11 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (3.0.0-rc03)

com.squareup.wire:wire-runtime MAVEN version 3.0.0-rc03 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:proto-pruner 3.0.0-rc03 - com.squareup.wire:wire-codegen-sample 3.0.0-rc03 -...

com.eulerstream:tiktok-live-proto (0.1.1), com.eulerstream:tiktok-live-proto-kotlin (0.1.1) +6 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (5.5.1)

com.squareup.wire:wire-runtime MAVEN version 5.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.eulerstream:tiktok-live-proto 0.1.1 - com.eulerstream:tiktok-live-proto-kotlin 0.1.1 -...

com.squareup.wire:wire-grpc-client (4.1.1), com.squareup.wire:wire-schema (4.1.1) potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.1.1)

com.squareup.wire:wire-runtime MAVEN version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.1.1 - com.squareup.wire:wire-schema 4.1.1 Source cves:...

ai.looktech.ltrpc.schema:app-server (>=1.7.0, <=1.7.1), ai.looktech.ltrpc.schema:bt-server (>=1.7.0, <=1.7.1) +11 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (5.5.0)

com.squareup.wire:wire-runtime MAVEN version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - ai.looktech.ltrpc.schema:app-server =1.7.0, =1.7.0, =1.6.1, =1.10.0, =0.4.2, =1.53.0-alpha,...

com.squareup.wire:wire-grpc-client (4.5.4), com.squareup.wire:wire-schema (4.5.4) +3 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.5.4)

com.squareup.wire:wire-runtime MAVEN version 4.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.5.4 - com.squareup.wire:wire-schema 4.5.4 -...

com.squareup.wire:wire-grpc-client (4.9.1), com.squareup.wire:wire-schema (4.9.1) +8 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.1)

com.squareup.wire:wire-runtime MAVEN version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.1 - com.squareup.wire:wire-schema 4.9.1 -...

com.squareup.wire:wire-grpc-client (4.9.11), com.squareup.wire:wire-schema (4.9.11) +4 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.11)

com.squareup.wire:wire-runtime MAVEN version 4.9.11 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.11 - com.squareup.wire:wire-schema 4.9.11 -...

com.squareup.wire:wire-grpc-client (4.9.5), com.squareup.wire:wire-schema (4.9.5) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.5)

com.squareup.wire:wire-runtime MAVEN version 4.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.5 - com.squareup.wire:wire-schema 4.9.5 -...

com.squareup.wire:wire-grpc-client (4.9.4), com.squareup.wire:wire-schema (4.9.4) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.4)

com.squareup.wire:wire-runtime MAVEN version 4.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.4 - com.squareup.wire:wire-schema 4.9.4 -...