497 matches found
php: php: Server impersonation via Common Name fallback in TLS verification
A flaw was found in PHP. This vulnerability allows server impersonation and potential information disclosure during Transport Layer Security TLS connections. When verifying peer certificates, PHP improperly falls back to matching the Common Name CN if no Subject Alternative Name SAN matches the...
EUVD-2026-102337
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolat...
PT-2026-114997
Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.11 Description The OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view fail to apply quote-safe encoding to the common name of a client when...
BIT-THRIFT-2026-85088 Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match
Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the...
CLEANSTART-2026-AU05968 PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name
Security vulnerability affects the php package. PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name...
EUVD-2026-95113
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate...
PT-2026-108051
Name of the Vulnerable Software and Affected Versions GnuTLS version 3.8.13 Description A hostname verification bypass allows attackers to circumvent the Common Name fallback mechanism, which is a process used to verify the identity of a server when the Subject Alternative Name is missing. This...
CVE-2026-85088
A flaw was found in Apache Thrift. During Transport Layer Security TLS certificate validation, the client libraries improperly evaluate the certificate's Common Name CN when subject alternative name SAN entries do not match the target host. A network-positioned attacker possessing a trusted...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation via improper evaluation of the certificate's Common Name during TLS certificate validation when subject alternative name entries do not match the target host. An attacker can intercept or tamper with...
PT-2026-104289
Name of the Vulnerable Software and Affected Versions Apache Thrift C++ library versions 0.7.0 through 0.24.0 Apache Thrift D library versions 0.9.0 through 0.24.0 Description Improper validation of certificates with host mismatches occurs in the C++ and D libraries. The default access manager fo...
thrift: thrift: Man-in-the-middle attacks via improper certificate validation
A flaw was found in Apache Thrift. During Transport Layer Security TLS certificate validation, the client libraries improperly evaluate the certificate's Common Name CN when subject alternative name SAN entries do not match the target host. A network-positioned attacker possessing a trusted...
PT-2026-105118
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...
PT-2026-105148
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...
SUSE CVE-2026-91769
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...
CVE-2026-91769
A flaw was found in PHP. This vulnerability allows server impersonation and potential information disclosure during Transport Layer Security TLS connections. When verifying peer certificates, PHP improperly falls back to matching the Common Name CN if no Subject Alternative Name SAN matches the...
PT-2026-99510
Name of the Vulnerable Software and Affected Versions wolfSSL version 5.9.2 Description A flaw exists where a certificate containing a Subject Alternative Name SAN other than a dNSName such as registeredID or iPAddress, but lacking a dNSName SAN, can bypass the Subject Common Name CN dNSName...
DEBIAN-CVE-2026-91769
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...
UBUNTU-CVE-2026-91769
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...
CVE-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...
CVE-2026-91769
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...