Common Weakness Enumeration
CWE-297
AllowedImproper Validation of Certificate with Host Mismatch
Abstraction: Variant · Status: Incomplete
The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
150 vulnerabilities reference this CWE, most recent first.
GHSA-4M7W-QMGQ-4WJ5
Vulnerability from github – Published: 2026-06-15 20:11 – Updated: 2026-06-15 20:11
VLAI
Summary
aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
Details
Summary
The server_hostname TLS SNI check can be bypassed when an existing connection is reused.
Impact
If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check.
Workaround
Disable keep_alive if you need to change the server_hostname check between requests.
Patch: https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.14.0"
},
"package": {
"ecosystem": "PyPI",
"name": "aiohttp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.14.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54275"
],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-15T20:11:13Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Summary\n\nThe `server_hostname` TLS SNI check can be bypassed when an existing connection is reused.\n\n### Impact\n\nIf an application makes multiple requests to the same domain, but with different per-request `server_hostname` parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check.\n\n### Workaround\n\nDisable keep_alive if you need to change the `server_hostname` check between requests.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0",
"id": "GHSA-4m7w-qmgq-4wj5",
"modified": "2026-06-15T20:11:13Z",
"published": "2026-06-15T20:11:13Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5"
},
{
"type": "PACKAGE",
"url": "https://github.com/aio-libs/aiohttp"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections"
}
GHSA-4PV3-CR63-M4PH
Vulnerability from github – Published: 2026-09-16 12:30 – Updated: 2026-09-17 21:31
VLAI
Details
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2026-59969"
],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T10:16:51Z",
"severity": "HIGH"
},
"details": "Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true\u00a0are enabled, the Java SSLSocket\u00a0quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.\n\n\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.",
"id": "GHSA-4pv3-cr63-m4ph",
"modified": "2026-09-17T21:31:34Z",
"published": "2026-09-16T12:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59969"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/09/15/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-52JG-6VW4-42P8
Vulnerability from github – Published: 2026-07-24 12:30 – Updated: 2026-07-24 12:30
VLAI
Details
Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) can provide any CA-signed certificate for a hostname that matches the configured allowlist or regex. This can lead to intercepting the CAS exchange, capturing the Ticket-Granting Ticket (TGT), and subsequently obtaining Service Tickets on behalf of the victim.
Because maintainers contact attempts were unsuccessful, vulnerabilities have only been confirmed in version 4.1.0 (Java Apereo CAS Client) and 3.6.4 (Jasig CAS Client) but may also affect other versions.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-15243"
],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-24T12:16:46Z",
"severity": "HIGH"
},
"details": "Apereo CAS Client\u00a0accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) can provide any CA-signed certificate for a hostname that matches the configured allowlist or regex. This can lead to\u00a0intercepting the CAS exchange, capturing the\u00a0Ticket-Granting Ticket (TGT), and subsequently obtaining Service Tickets on behalf of the victim.\u00a0\n\n\nBecause maintainers contact attempts were unsuccessful, vulnerabilities have only been confirmed in version 4.1.0 (Java Apereo CAS Client) and\u00a03.6.4 (Jasig CAS Client) but may also affect other versions.",
"id": "GHSA-52jg-6vw4-42p8",
"modified": "2026-07-24T12:30:53Z",
"published": "2026-07-24T12:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15243"
},
{
"type": "WEB",
"url": "https://cert.pl/en/posts/2026/07/CVE-2026-15243"
},
{
"type": "WEB",
"url": "https://www.apereo.org/programs/software/cas"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-568Q-9FW5-28WF
Vulnerability from github – Published: 2018-10-19 16:53 – Updated: 2020-06-16 21:00
VLAI
Summary
Moderate severity vulnerability that affects org.postgresql:pgjdbc-aggregate
Details
A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.postgresql:pgjdbc-aggregate"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "42.2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-10936"
],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:00:08Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.",
"id": "GHSA-568q-9fw5-28wf",
"modified": "2020-06-16T21:00:08Z",
"published": "2018-10-19T16:53:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10936"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10936"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-568q-9fw5-28wf"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E"
},
{
"type": "WEB",
"url": "https://www.postgresql.org/about/news/1883"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/105220"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Moderate severity vulnerability that affects org.postgresql:pgjdbc-aggregate"
}
GHSA-5CC2-282F-JJQ2
Vulnerability from github – Published: 2026-07-16 09:32 – Updated: 2026-08-31 22:35
VLAI
Summary
Snowflake Connector for Python improperly verifies TLS hostnames
Details
Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this by intercepting or redirecting network traffic and presenting a certificate signed by any trusted CA for any domain, causing the connector to accept connections without validating that the certificate matched the requested hostname. Successful exploitation requires an on-path traffic interception capability (e.g. ARP/DNS poisoning, rogue access point, BGP hijacking, or malicious proxy/exit node). This vulnerability may have exposed credentials, query data, and staged file contents to interception and tampering, and may have enabled the attacker to issue arbitrary SQL within the context of the victim's connector session. Impact is limited by the privileges of the affected Snowflake role. The fix is available in Snowflake Connector for Python versions 4.7.1 and 3.18.1. Users must manually upgrade.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "snowflake-connector-python"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.18.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "snowflake-connector-python"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.7.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-15925"
],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-31T22:35:14Z",
"nvd_published_at": "2026-07-16T07:16:47Z",
"severity": "CRITICAL"
},
"details": "Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this by intercepting or redirecting network traffic and presenting a certificate signed by any trusted CA for any domain, causing the connector to accept connections without validating that the certificate matched the requested hostname. Successful exploitation requires an on-path traffic interception capability (e.g. ARP/DNS poisoning, rogue access point, BGP hijacking, or malicious proxy/exit node). This vulnerability may have exposed credentials, query data, and staged file contents to interception and tampering, and may have enabled the attacker to issue arbitrary SQL within the context of the victim\u0027s connector session. Impact is limited by the privileges of the affected Snowflake role. The fix is available in Snowflake Connector for Python versions 4.7.1 and 3.18.1. Users must manually upgrade.",
"id": "GHSA-5cc2-282f-jjq2",
"modified": "2026-08-31T22:35:14Z",
"published": "2026-07-16T09:32:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15925"
},
{
"type": "WEB",
"url": "https://github.com/snowflakedb/snowflake-connector-python/commit/8969d6dc027092ee868965db022478b6c0fa40a1"
},
{
"type": "PACKAGE",
"url": "https://github.com/snowflakedb/snowflake-connector-python"
},
{
"type": "WEB",
"url": "https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v3.18.1"
},
{
"type": "WEB",
"url": "https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v4.7.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Snowflake Connector for Python improperly verifies TLS hostnames"
}
GHSA-5FVG-QWCP-R325
Vulnerability from github – Published: 2026-03-03 12:31 – Updated: 2026-03-04 20:17
VLAI
Summary
Apache Ranger Vulnerable to Improper Validation of Certificate with Host Mismatch
Details
Hostname verification bypass issue in Apache Ranger NiFiRegistryClient/NiFiClient is reported in Apache Ranger versions <= 2.7.0.
Users are recommended to upgrade to version 2.8.0, which fixes this issue.
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.ranger:ranger-nifi-registry-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-59060"
],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-04T20:17:28Z",
"nvd_published_at": "2026-03-03T11:16:14Z",
"severity": "MODERATE"
},
"details": "Hostname verification bypass issue in Apache Ranger NiFiRegistryClient/NiFiClient is reported in Apache Ranger versions \u003c= 2.7.0.\n\nUsers are recommended to upgrade to version 2.8.0, which fixes this issue.",
"id": "GHSA-5fvg-qwcp-r325",
"modified": "2026-03-04T20:17:28Z",
"published": "2026-03-03T12:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59060"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/ranger"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/c4plx81z3xs86vgl3fd95y3q7hhtff05"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/03/02/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Ranger Vulnerable to Improper Validation of Certificate with Host Mismatch"
}
GHSA-5GM2-C485-9Q6Q
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-05-24 19:03
VLAI
Details
A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.
{
"affected": [],
"aliases": [
"CVE-2020-14387"
],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-27T20:15:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.",
"id": "GHSA-5gm2-c485-9q6q",
"modified": "2022-05-24T19:03:34Z",
"published": "2022-05-24T19:03:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14387"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1875549"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-5WF9-H793-W73C
Vulnerability from github – Published: 2026-10-02 22:35 – Updated: 2026-10-02 22:35
VLAI
Summary
Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks
Details
Summary
Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in some cases.
Details
https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/tls/config.go#L333-L347
If r.Config.ServerName is empty, DNSName will be empty and certs[0].Verify(opts) will not verify against dNSName or iPAddress.
If a user pins a well-known and non-self-signed CA, an attacker can issue a leaf certificate through the Root CA (using the attacker's own domain name or IP address) and hijack the connections.
In Go crypto/tls, either ServerName or InsecureSkipVerify must be specified in the tls.Config. If the user specifies pinnedPeerCertSha256, InsecureSkipVerify will always be true so ServerName can be empty.
In most cases, if the user does not specify the serverName, Xray-core will use the server address as the r.Config.ServerName.
Thanks to GetTLSConfig(tls.WithDestination(dest)), ServerName will usually not be empty.
However, there are some leftovers:
- https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/hysteria/dialer.go#L348
GetTLSConfig() without tls.WithDestination(dest).
- https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/grpc/dial.go#L139-L142
GetTLSConfig() without tls.WithDestination(dest). Although ServerName will not be empty if address is a domain name, ServerName will be left empty if address is an IP address.
ServerName is not equivalent to SNI.
ServerName is used to verify the hostname on the returned certificates unless InsecureSkipVerify is given. It is also included in the client's handshake to support virtual hosting unless it is an IP address.
In these cases, if the user does not specify the serverName, Xray will not use the server address as the r.Config.ServerName and r.Config.ServerName will be left empty.
PoC
client.json{
"log": {
"loglevel": "debug"
},
"inbounds": [
{
"listen": "127.0.0.1",
"port": 1080,
"protocol": "socks"
}
],
"outbounds": [
{
"protocol": "hysteria",
"settings": {
"address": "127.0.0.1",
"port": 443,
"version": 2
},
"streamSettings": {
"security": "tls",
"network": "hysteria",
"tlsSettings": {
"pinnedPeerCertSha256": "e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f"
},
"hysteriaSettings": {
"version": 2,
"auth": "auth"
}
}
}
]
}
{
"log": {
"loglevel": "debug"
},
"inbounds": [
{
"listen": "127.0.0.1",
"port": 443,
"protocol": "hysteria",
"settings": {
"version": 2
},
"streamSettings": {
"security": "tls",
"network": "hysteria",
"tlsSettings": {
"certificates": [
{
"certificateFile": "server2.crt",
"keyFile": "server2.key"
}
]
},
"hysteriaSettings": {
"version": 2,
"auth": "auth"
}
}
}
],
"outbounds": [
{
"protocol": "freedom"
}
]
}
xray tls hash --cert server1.crt
Leaf SHA256: 7f0f1a28f96b7d74e60bbbc263a108ac1243345110f77c45e5bc2fe02851551d
CA <Root> SHA256: e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f
xray tls hash --cert server2.crt
Leaf SHA256: 32a842063280252bc746a913dce8e38b526021bfc7a2d784632d413dbee0c69c
CA <Root> SHA256: e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f
-----BEGIN CERTIFICATE-----
MIIDMjCCAhqgAwIBAgIUEt5YzaTYeiyClv/htnnbK8FJ70wwDQYJKoZIhvcNAQEL
BQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yNjA3MDMxMDE0MzZaFw0zNjA2MzAxMDE0
MzZaMBQxEjAQBgNVBAMMCTEyNy4wLjAuMTCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBAIbLr7M4oU6JPvjnSfkks6oyBl6+j2Ykl32uJX953n/rd1+AO+60
6zzx32eLh0EFGO7SvAsXEsklcGmrwduxCgv7RPjJyMK4pcZ8d3OF5ZxhBJH5i83K
cZkTBNu/oKgAJ75BmjVh5LP3rnMASWTLntpK3sfRcXAaZpvvyCSeKQTsoxmRNSzB
S3JPvtbbpQ7Q2RgH/ZOcRTNp7jjxCdXut1oTWM3R/MX2YSYf7+lIL0T7g04dp0oI
y344uIZISNYFq6LSK2ZLbVqhqC45Zg+TQmqnC3fvhAUPIOxUeJKtf+E2F1qjuXWb
y/dk5885n95ooZ2PqXi6mkfluNzt5CcoqU0CAwEAAaOBgDB+MAkGA1UdEwQCMAAw
CwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEQQIMAaHBH8A
AAEwHQYDVR0OBBYEFLKSHMaY2Q/VrQYf+dnPctzkYeX9MB8GA1UdIwQYMBaAFAaO
Ih36y0UgXPa9z7/hUwvaasqmMA0GCSqGSIb3DQEBCwUAA4IBAQCvWejnbhNuGrFR
L3FSeFcLXSyNEMl43E0ClUmQ6bZz1wC3C5nPwYijpUatf2s4pCTt6yBPLR4+AgdD
e6IR8qJqU1HC6uKtr4beVLx1900K+7AM9nMIW9reOHVvSmiUb7zbw/xfBBbU/ssw
M30/bM2KaI6d7av7Co1M4PoQfSop9PIN8TNAJSywCstmUara72/qt0I0QDJ433Cy
U5tjtOLDBPszzeS4f7wbTb5V3KULebc6KkjUidrW8E3qFeXaQ/o34huNmYT9HXCS
/v/eWrmUSsroYk+tyBARW2dXZ1CQgdOXd9cxKNaRTUm3glprCWQdNN8Gtu5yyWRQ
29bSzHij
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDATCCAemgAwIBAgIURtJTQ4YzS/SJSsVG2pyuRg4tBg8wDQYJKoZIhvcNAQEL
BQAwDzENMAsGA1UEAwwEUm9vdDAgFw0yNjA3MDMxMDExNTlaGA8yMTI2MDYwOTEw
MTE1OVowDzENMAsGA1UEAwwEUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBANLlP546TAp9/dns0xk482z0ZCVdBbh7BaMx4sY/4Mdu0RatYdp+6yL7
dTzJJX3rb+NdsVbpozj/660DS1SN0osNa7Nm1cp2CXf39PdKJ5WrbY1UCuE5cD6n
W7qFTLZR/52RnN0UoththnNyjurEf3m8GTtFOrfmH6qT6psZmgRefLh/OZT6PXUT
ZKPBHFhOr1YkuwO2D15pnRZ/2OBBkExsjyv5Y/m8IJfd+qK8rPrzJavRNEjfClfN
3ScZEE1eOdrutuxRNpawEIB3gLfp/zWbZe/jMRyqrOAy1Bqy1JpwaeAJn96DShru
6S8xim6PkvqY4mqOdTTCz/sgy/XLRicCAwEAAaNTMFEwHQYDVR0OBBYEFAaOIh36
y0UgXPa9z7/hUwvaasqmMB8GA1UdIwQYMBaAFAaOIh36y0UgXPa9z7/hUwvaasqm
MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALqZN9Rk7LIPqjzb
h3Z4iTVYdZXnUckPKVF0pH2Xx4R5Bcgb3XbptpRViisit3Ltwn8CfR7SYq4mYbnN
/l3ty9neR1KPDtE8CgM1lLqw1t5iN+OW60S1cYlrJFGxGUdr5W9Z/toH9lDWCxsg
T9+ooe+9hx4F8bw3Nnslt+FiDzbjMNOGxPzw7RZFV8n8JzxpIOaXO5quDSuoDdir
kXV4FO0kl19EesaUyavy0Rc3sef8vyAvbT1CmjRd3LLpGWlaTrii0xVfq2YY7Jf7
6Tb9fpJLOoAv4nWC82zZ0U94c7ffM4P+P7/qMO1R1PM0qHdsEo/O+FXwUdnkOwNs
6+IZCAM=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDMjCCAhqgAwIBAgIUEt5YzaTYeiyClv/htnnbK8FJ700wDQYJKoZIhvcNAQEL
BQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yNjA3MDMxMDE1MjZaFw0zNjA2MzAxMDE1
MjZaMBQxEjAQBgNVBAMMCTEyNy4wLjAuMjCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBAJjuTx6SOgwTqubOWTGzTf5iQ3nKRyYCHypmcyDLKASaV9n6+oDz
WL9Lp9iR4uOrOyOr26eu8bud/yBnFiRz8pAP74ixjFIP8tgDZeSe4rr/4jAKi/Al
1OhQSjvKyaIpSz4uM4H39dQwDyL2hJnKDYmUa7J582b2EgYU7vro6ZvifCIh/i0q
ZIgVOJdWkjT+x8xAxfqW3/hC0cA03Ajc3XBPEBGOTASZca8IT10sdgUiBGMHMeBW
HLLzz887EdpPn864sy5cQj509ekEP7jc3EBxnxwpqyqktr+Q+h8ExWM7CVIy9Z+H
ORT2TxzxefoYFY28a6P7VJ2NNnRJFgIpPf0CAwEAAaOBgDB+MAkGA1UdEwQCMAAw
CwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEQQIMAaHBH8A
AAIwHQYDVR0OBBYEFKsSvs+FuZ6lJawi4f7IjAUpfOOBMB8GA1UdIwQYMBaAFAaO
Ih36y0UgXPa9z7/hUwvaasqmMA0GCSqGSIb3DQEBCwUAA4IBAQBW6Vj7cwNkD6Mm
z7kmAl8Xhqste0KcafJzFXaJLHJLfH2ICQ5MtvtyRv+fFbfI2TqfYrQOZWybLJ1I
L/MpsccRqMGVvhpe3PNyQKgGnflGpLgN8DsswzrYqFUiWAamJ2GLEz/0DHwGqiy5
Vn4ATcx53Mm4tbWF+87Ul7AlfKaj7YgFq3t1UJWUWBt4GVcQJzSn2Yl2J7vnek4u
t7kYrnhw44IBt8Oz2StRH89gulbplVCwJRimmkJQyhK73M2PfRwTOaDSjHqE0FA7
t5JXK1zts2WyP6tZWtyUIDq6hSdvYjyxGffZ5kt810sjcyrk/TnOhFXRuiC5eoXX
DfQWbk1o
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDATCCAemgAwIBAgIURtJTQ4YzS/SJSsVG2pyuRg4tBg8wDQYJKoZIhvcNAQEL
BQAwDzENMAsGA1UEAwwEUm9vdDAgFw0yNjA3MDMxMDExNTlaGA8yMTI2MDYwOTEw
MTE1OVowDzENMAsGA1UEAwwEUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBANLlP546TAp9/dns0xk482z0ZCVdBbh7BaMx4sY/4Mdu0RatYdp+6yL7
dTzJJX3rb+NdsVbpozj/660DS1SN0osNa7Nm1cp2CXf39PdKJ5WrbY1UCuE5cD6n
W7qFTLZR/52RnN0UoththnNyjurEf3m8GTtFOrfmH6qT6psZmgRefLh/OZT6PXUT
ZKPBHFhOr1YkuwO2D15pnRZ/2OBBkExsjyv5Y/m8IJfd+qK8rPrzJavRNEjfClfN
3ScZEE1eOdrutuxRNpawEIB3gLfp/zWbZe/jMRyqrOAy1Bqy1JpwaeAJn96DShru
6S8xim6PkvqY4mqOdTTCz/sgy/XLRicCAwEAAaNTMFEwHQYDVR0OBBYEFAaOIh36
y0UgXPa9z7/hUwvaasqmMB8GA1UdIwQYMBaAFAaOIh36y0UgXPa9z7/hUwvaasqm
MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALqZN9Rk7LIPqjzb
h3Z4iTVYdZXnUckPKVF0pH2Xx4R5Bcgb3XbptpRViisit3Ltwn8CfR7SYq4mYbnN
/l3ty9neR1KPDtE8CgM1lLqw1t5iN+OW60S1cYlrJFGxGUdr5W9Z/toH9lDWCxsg
T9+ooe+9hx4F8bw3Nnslt+FiDzbjMNOGxPzw7RZFV8n8JzxpIOaXO5quDSuoDdir
kXV4FO0kl19EesaUyavy0Rc3sef8vyAvbT1CmjRd3LLpGWlaTrii0xVfq2YY7Jf7
6Tb9fpJLOoAv4nWC82zZ0U94c7ffM4P+P7/qMO1R1PM0qHdsEo/O+FXwUdnkOwNs
6+IZCAM=
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCY7k8ekjoME6rm
zlkxs03+YkN5ykcmAh8qZnMgyygEmlfZ+vqA81i/S6fYkeLjqzsjq9unrvG7nf8g
ZxYkc/KQD++IsYxSD/LYA2XknuK6/+IwCovwJdToUEo7ysmiKUs+LjOB9/XUMA8i
9oSZyg2JlGuyefNm9hIGFO766Omb4nwiIf4tKmSIFTiXVpI0/sfMQMX6lt/4QtHA
NNwI3N1wTxARjkwEmXGvCE9dLHYFIgRjBzHgVhyy88/POxHaT5/OuLMuXEI+dPXp
BD+43NxAcZ8cKasqpLa/kPofBMVjOwlSMvWfhzkU9k8c8Xn6GBWNvGuj+1SdjTZ0
SRYCKT39AgMBAAECggEABa+oq/GSbHQHwPSvrtAkqH51VVAu1Iw0JfKwuamsF324
of95tHU32ccBmuUTu1TYylL/xAyWatwtSgJjOaBBBte814eIeN2kcSExNu6sbfkJ
KzGdMeTqNWgU1oPL+vZPmKSFoEG8t3LBAVMKq6AuYCzvUy/DG9Mu6OB64UPrObND
neXZT8YZ2Ux0vEV9BAc0z+9tdWVjBy+l5ei6wpjhP69GZiVOsLmKTg/MDT4FN+Pi
WJbyHcL1IKTRxxNxDPInBKhEMrxKKAABeXlp5nwnz0gkgUoxK3YHZmxAPr6yCcHP
ffeMjpE5BaRKzhimKrOJB4LUES24ltjo+5v5GmZzYQKBgQDSbhiNQpmhOk4ICzwJ
8DMCAigaDm2cD/qC66OFrHhQfr7EC9MRKKC/8WlZYgNepxZ1ZM95+GJu5aTsh7d2
HknwJkxkbTadfRcch9HQun68Y814G0LBDuDRRc9OnBQW6Gr4jTFDP+uqQl6gAfu4
QOjATymrRa5S/21MkQ3Ryb5H4QKBgQC6DI1ETmfvXCOVpEUM9IjeEbiAjVYbUjBL
GEOhE0izOv8mjSEgifMSEXJMn58F4nW/UoxtDobTAhQ/WO5BUVCEeQnOAXhV57jU
/t/fBbdC7nrVnfFl9KmsOV3LcxUo0yE/x7UiHd1QlwtOTl1KPFQa9WpSehxjjQAS
mHYM5PhJnQKBgQCIGHCEm/hkkCL7jNiNzO4QdHifMYmuj58DoYcm4z8FQJP8k3E0
/cPJoEb0ajGnvAUIc+TEC+MNujSKTdRX7or/aKWrpf7WqJqT9zu59YQWL64p6eeo
mQjKEI5dVxCfKD5W9mpQBj1S5o3wipfUuRZPmmNmxDBUuaJlDMOVVRddwQKBgCUl
bmst8GiFEAHHq5W7mTwlc54PGhsYXNYRgSc+72wBooHy+aNCh8qauyR7VkfZgELz
21/G37pvltVTDzbxYk8gz4lXF8ynGGtGfDJONNnjPZk7EMCXiez+AzEkyBu/k8rl
N9AZAGAf2D0JPm0dAHnleBYBlXt24oXT9PX8HWqtAoGBALRX6V1U+bKwMih3N21b
1w/ELI7L1BBAPqJxiQPSOa7kshamZgFenbH1wFLIXz6YwaEOOmYiId6lFjcJaBbF
+R4HfxBhOuY6cvD0vEROIRntaqsj4zJXahlZZ9uG1EAYrY2tGKkCUMKN2IBE+WWS
3YTH4WIOsCZriuaHIAyjsCcv
-----END PRIVATE KEY-----
Expected behavior: The client will fail to establish the connection.
Actual behavior: The client succeeds in establishing the connection.
Impact
Xray-core from v26.1.13 to the latest version
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/xtls/xray-core"
},
"ranges": [
{
"events": [
{
"introduced": "1.260113.0"
},
{
"fixed": "1.260327.1-0.20260710210335-64fada32b5b9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-02T22:35:51Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\nPinning a CA certificate via `pinnedPeerCertSha256` can lead to the success of MITM attacks in some cases.\n\n### Details\n\nhttps://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/tls/config.go#L333-L347\n\nIf `r.Config.ServerName` is empty, `DNSName` will be empty and `certs[0].Verify(opts)` will not verify against dNSName or iPAddress.\n\nIf a user pins a well-known and non-self-signed CA, an attacker can issue a leaf certificate through the Root CA (using the attacker\u0027s own domain name or IP address) and hijack the connections.\n\nIn Go crypto/tls, either ServerName or InsecureSkipVerify must be specified in the `tls.Config`. If the user specifies `pinnedPeerCertSha256`, InsecureSkipVerify will always be true so ServerName can be empty.\n\nIn most cases, if the user does not specify the `serverName`, Xray-core will use the server address as the `r.Config.ServerName`.\n\nThanks to `GetTLSConfig(tls.WithDestination(dest))`, ServerName will usually not be empty.\n\nHowever, there are some leftovers:\n\n- https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/hysteria/dialer.go#L348\n\n `GetTLSConfig()` without `tls.WithDestination(dest)`.\n\n- https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/grpc/dial.go#L139-L142\n\n `GetTLSConfig()` without `tls.WithDestination(dest)`. Although ServerName will not be empty if `address` is a domain name, ServerName will be left empty if `address` is an IP address.\n\n ServerName is not equivalent to SNI.\n\n \u003e ServerName is used to verify the hostname on the returned certificates unless InsecureSkipVerify is given. It is also included in the client\u0027s handshake to support virtual hosting unless it is an IP address.\n\nIn these cases, if the user does not specify the `serverName`, Xray will not use the server address as the `r.Config.ServerName` and `r.Config.ServerName` will be left empty.\n\n\n### PoC\n\n\u003cdetails\u003e\n\nclient.json\n```json\n{\n\t\"log\": {\n\t\t\"loglevel\": \"debug\"\n\t},\n\t\"inbounds\": [\n\t\t{\n\t\t\t\"listen\": \"127.0.0.1\",\n\t\t\t\"port\": 1080,\n\t\t\t\"protocol\": \"socks\"\n\t\t}\n\t],\n\t\"outbounds\": [\n\t\t{\n\t\t\t\"protocol\": \"hysteria\",\n\t\t\t\"settings\": {\n\t\t\t\t\"address\": \"127.0.0.1\",\n\t\t\t\t\"port\": 443,\n\t\t\t\t\"version\": 2\n\t\t\t},\n\t\t\t\"streamSettings\": {\n\t\t\t\t\"security\": \"tls\",\n\t\t\t\t\"network\": \"hysteria\",\n\t\t\t\t\"tlsSettings\": {\n\t\t\t\t\t\"pinnedPeerCertSha256\": \"e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f\"\n\t\t\t\t},\n\t\t\t\t\"hysteriaSettings\": {\n\t\t\t\t\t\"version\": 2,\n\t\t\t\t\t\"auth\": \"auth\"\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t]\n}\n```\n\nserver.json\n```json\n{\n\t\"log\": {\n\t\t\"loglevel\": \"debug\"\n\t},\n\t\"inbounds\": [\n\t\t{\n\t\t\t\"listen\": \"127.0.0.1\",\n\t\t\t\"port\": 443,\n\t\t\t\"protocol\": \"hysteria\",\n\t\t\t\"settings\": {\n\t\t\t\t\"version\": 2\n\t\t\t},\n\t\t\t\"streamSettings\": {\n\t\t\t\t\"security\": \"tls\",\n\t\t\t\t\"network\": \"hysteria\",\n\t\t\t\t\"tlsSettings\": {\n\t\t\t\t\t\"certificates\": [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\"certificateFile\": \"server2.crt\",\n\t\t\t\t\t\t\t\"keyFile\": \"server2.key\"\n\t\t\t\t\t\t}\n\t\t\t\t\t]\n\t\t\t\t},\n\t\t\t\t\"hysteriaSettings\": {\n\t\t\t\t\t\"version\": 2,\n\t\t\t\t\t\"auth\": \"auth\"\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t],\n\t\"outbounds\": [\n\t\t{\n\t\t\t\"protocol\": \"freedom\"\n\t\t}\n\t]\n}\n```\n\nBoth `server1.crt` and `server2.crt` are issued by the same CA.\n`server1.crt` is subjected to 127.0.0.1.\n`server2.crt` is subjected to 127.0.0.2.\n\n```\nxray tls hash --cert server1.crt\nLeaf SHA256: 7f0f1a28f96b7d74e60bbbc263a108ac1243345110f77c45e5bc2fe02851551d\nCA \u003cRoot\u003e SHA256: e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f\n\nxray tls hash --cert server2.crt\nLeaf SHA256: 32a842063280252bc746a913dce8e38b526021bfc7a2d784632d413dbee0c69c\nCA \u003cRoot\u003e SHA256: e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f\n```\n\nserver1.crt\n```\n-----BEGIN CERTIFICATE-----\nMIIDMjCCAhqgAwIBAgIUEt5YzaTYeiyClv/htnnbK8FJ70wwDQYJKoZIhvcNAQEL\nBQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yNjA3MDMxMDE0MzZaFw0zNjA2MzAxMDE0\nMzZaMBQxEjAQBgNVBAMMCTEyNy4wLjAuMTCCASIwDQYJKoZIhvcNAQEBBQADggEP\nADCCAQoCggEBAIbLr7M4oU6JPvjnSfkks6oyBl6+j2Ykl32uJX953n/rd1+AO+60\n6zzx32eLh0EFGO7SvAsXEsklcGmrwduxCgv7RPjJyMK4pcZ8d3OF5ZxhBJH5i83K\ncZkTBNu/oKgAJ75BmjVh5LP3rnMASWTLntpK3sfRcXAaZpvvyCSeKQTsoxmRNSzB\nS3JPvtbbpQ7Q2RgH/ZOcRTNp7jjxCdXut1oTWM3R/MX2YSYf7+lIL0T7g04dp0oI\ny344uIZISNYFq6LSK2ZLbVqhqC45Zg+TQmqnC3fvhAUPIOxUeJKtf+E2F1qjuXWb\ny/dk5885n95ooZ2PqXi6mkfluNzt5CcoqU0CAwEAAaOBgDB+MAkGA1UdEwQCMAAw\nCwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEQQIMAaHBH8A\nAAEwHQYDVR0OBBYEFLKSHMaY2Q/VrQYf+dnPctzkYeX9MB8GA1UdIwQYMBaAFAaO\nIh36y0UgXPa9z7/hUwvaasqmMA0GCSqGSIb3DQEBCwUAA4IBAQCvWejnbhNuGrFR\nL3FSeFcLXSyNEMl43E0ClUmQ6bZz1wC3C5nPwYijpUatf2s4pCTt6yBPLR4+AgdD\ne6IR8qJqU1HC6uKtr4beVLx1900K+7AM9nMIW9reOHVvSmiUb7zbw/xfBBbU/ssw\nM30/bM2KaI6d7av7Co1M4PoQfSop9PIN8TNAJSywCstmUara72/qt0I0QDJ433Cy\nU5tjtOLDBPszzeS4f7wbTb5V3KULebc6KkjUidrW8E3qFeXaQ/o34huNmYT9HXCS\n/v/eWrmUSsroYk+tyBARW2dXZ1CQgdOXd9cxKNaRTUm3glprCWQdNN8Gtu5yyWRQ\n29bSzHij\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIDATCCAemgAwIBAgIURtJTQ4YzS/SJSsVG2pyuRg4tBg8wDQYJKoZIhvcNAQEL\nBQAwDzENMAsGA1UEAwwEUm9vdDAgFw0yNjA3MDMxMDExNTlaGA8yMTI2MDYwOTEw\nMTE1OVowDzENMAsGA1UEAwwEUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC\nAQoCggEBANLlP546TAp9/dns0xk482z0ZCVdBbh7BaMx4sY/4Mdu0RatYdp+6yL7\ndTzJJX3rb+NdsVbpozj/660DS1SN0osNa7Nm1cp2CXf39PdKJ5WrbY1UCuE5cD6n\nW7qFTLZR/52RnN0UoththnNyjurEf3m8GTtFOrfmH6qT6psZmgRefLh/OZT6PXUT\nZKPBHFhOr1YkuwO2D15pnRZ/2OBBkExsjyv5Y/m8IJfd+qK8rPrzJavRNEjfClfN\n3ScZEE1eOdrutuxRNpawEIB3gLfp/zWbZe/jMRyqrOAy1Bqy1JpwaeAJn96DShru\n6S8xim6PkvqY4mqOdTTCz/sgy/XLRicCAwEAAaNTMFEwHQYDVR0OBBYEFAaOIh36\ny0UgXPa9z7/hUwvaasqmMB8GA1UdIwQYMBaAFAaOIh36y0UgXPa9z7/hUwvaasqm\nMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALqZN9Rk7LIPqjzb\nh3Z4iTVYdZXnUckPKVF0pH2Xx4R5Bcgb3XbptpRViisit3Ltwn8CfR7SYq4mYbnN\n/l3ty9neR1KPDtE8CgM1lLqw1t5iN+OW60S1cYlrJFGxGUdr5W9Z/toH9lDWCxsg\nT9+ooe+9hx4F8bw3Nnslt+FiDzbjMNOGxPzw7RZFV8n8JzxpIOaXO5quDSuoDdir\nkXV4FO0kl19EesaUyavy0Rc3sef8vyAvbT1CmjRd3LLpGWlaTrii0xVfq2YY7Jf7\n6Tb9fpJLOoAv4nWC82zZ0U94c7ffM4P+P7/qMO1R1PM0qHdsEo/O+FXwUdnkOwNs\n6+IZCAM=\n-----END CERTIFICATE-----\n```\n\nserver2.crt\n```\n-----BEGIN CERTIFICATE-----\nMIIDMjCCAhqgAwIBAgIUEt5YzaTYeiyClv/htnnbK8FJ700wDQYJKoZIhvcNAQEL\nBQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yNjA3MDMxMDE1MjZaFw0zNjA2MzAxMDE1\nMjZaMBQxEjAQBgNVBAMMCTEyNy4wLjAuMjCCASIwDQYJKoZIhvcNAQEBBQADggEP\nADCCAQoCggEBAJjuTx6SOgwTqubOWTGzTf5iQ3nKRyYCHypmcyDLKASaV9n6+oDz\nWL9Lp9iR4uOrOyOr26eu8bud/yBnFiRz8pAP74ixjFIP8tgDZeSe4rr/4jAKi/Al\n1OhQSjvKyaIpSz4uM4H39dQwDyL2hJnKDYmUa7J582b2EgYU7vro6ZvifCIh/i0q\nZIgVOJdWkjT+x8xAxfqW3/hC0cA03Ajc3XBPEBGOTASZca8IT10sdgUiBGMHMeBW\nHLLzz887EdpPn864sy5cQj509ekEP7jc3EBxnxwpqyqktr+Q+h8ExWM7CVIy9Z+H\nORT2TxzxefoYFY28a6P7VJ2NNnRJFgIpPf0CAwEAAaOBgDB+MAkGA1UdEwQCMAAw\nCwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEQQIMAaHBH8A\nAAIwHQYDVR0OBBYEFKsSvs+FuZ6lJawi4f7IjAUpfOOBMB8GA1UdIwQYMBaAFAaO\nIh36y0UgXPa9z7/hUwvaasqmMA0GCSqGSIb3DQEBCwUAA4IBAQBW6Vj7cwNkD6Mm\nz7kmAl8Xhqste0KcafJzFXaJLHJLfH2ICQ5MtvtyRv+fFbfI2TqfYrQOZWybLJ1I\nL/MpsccRqMGVvhpe3PNyQKgGnflGpLgN8DsswzrYqFUiWAamJ2GLEz/0DHwGqiy5\nVn4ATcx53Mm4tbWF+87Ul7AlfKaj7YgFq3t1UJWUWBt4GVcQJzSn2Yl2J7vnek4u\nt7kYrnhw44IBt8Oz2StRH89gulbplVCwJRimmkJQyhK73M2PfRwTOaDSjHqE0FA7\nt5JXK1zts2WyP6tZWtyUIDq6hSdvYjyxGffZ5kt810sjcyrk/TnOhFXRuiC5eoXX\nDfQWbk1o\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIDATCCAemgAwIBAgIURtJTQ4YzS/SJSsVG2pyuRg4tBg8wDQYJKoZIhvcNAQEL\nBQAwDzENMAsGA1UEAwwEUm9vdDAgFw0yNjA3MDMxMDExNTlaGA8yMTI2MDYwOTEw\nMTE1OVowDzENMAsGA1UEAwwEUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC\nAQoCggEBANLlP546TAp9/dns0xk482z0ZCVdBbh7BaMx4sY/4Mdu0RatYdp+6yL7\ndTzJJX3rb+NdsVbpozj/660DS1SN0osNa7Nm1cp2CXf39PdKJ5WrbY1UCuE5cD6n\nW7qFTLZR/52RnN0UoththnNyjurEf3m8GTtFOrfmH6qT6psZmgRefLh/OZT6PXUT\nZKPBHFhOr1YkuwO2D15pnRZ/2OBBkExsjyv5Y/m8IJfd+qK8rPrzJavRNEjfClfN\n3ScZEE1eOdrutuxRNpawEIB3gLfp/zWbZe/jMRyqrOAy1Bqy1JpwaeAJn96DShru\n6S8xim6PkvqY4mqOdTTCz/sgy/XLRicCAwEAAaNTMFEwHQYDVR0OBBYEFAaOIh36\ny0UgXPa9z7/hUwvaasqmMB8GA1UdIwQYMBaAFAaOIh36y0UgXPa9z7/hUwvaasqm\nMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALqZN9Rk7LIPqjzb\nh3Z4iTVYdZXnUckPKVF0pH2Xx4R5Bcgb3XbptpRViisit3Ltwn8CfR7SYq4mYbnN\n/l3ty9neR1KPDtE8CgM1lLqw1t5iN+OW60S1cYlrJFGxGUdr5W9Z/toH9lDWCxsg\nT9+ooe+9hx4F8bw3Nnslt+FiDzbjMNOGxPzw7RZFV8n8JzxpIOaXO5quDSuoDdir\nkXV4FO0kl19EesaUyavy0Rc3sef8vyAvbT1CmjRd3LLpGWlaTrii0xVfq2YY7Jf7\n6Tb9fpJLOoAv4nWC82zZ0U94c7ffM4P+P7/qMO1R1PM0qHdsEo/O+FXwUdnkOwNs\n6+IZCAM=\n-----END CERTIFICATE-----\n```\n\nserver2.key\n```\n-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCY7k8ekjoME6rm\nzlkxs03+YkN5ykcmAh8qZnMgyygEmlfZ+vqA81i/S6fYkeLjqzsjq9unrvG7nf8g\nZxYkc/KQD++IsYxSD/LYA2XknuK6/+IwCovwJdToUEo7ysmiKUs+LjOB9/XUMA8i\n9oSZyg2JlGuyefNm9hIGFO766Omb4nwiIf4tKmSIFTiXVpI0/sfMQMX6lt/4QtHA\nNNwI3N1wTxARjkwEmXGvCE9dLHYFIgRjBzHgVhyy88/POxHaT5/OuLMuXEI+dPXp\nBD+43NxAcZ8cKasqpLa/kPofBMVjOwlSMvWfhzkU9k8c8Xn6GBWNvGuj+1SdjTZ0\nSRYCKT39AgMBAAECggEABa+oq/GSbHQHwPSvrtAkqH51VVAu1Iw0JfKwuamsF324\nof95tHU32ccBmuUTu1TYylL/xAyWatwtSgJjOaBBBte814eIeN2kcSExNu6sbfkJ\nKzGdMeTqNWgU1oPL+vZPmKSFoEG8t3LBAVMKq6AuYCzvUy/DG9Mu6OB64UPrObND\nneXZT8YZ2Ux0vEV9BAc0z+9tdWVjBy+l5ei6wpjhP69GZiVOsLmKTg/MDT4FN+Pi\nWJbyHcL1IKTRxxNxDPInBKhEMrxKKAABeXlp5nwnz0gkgUoxK3YHZmxAPr6yCcHP\nffeMjpE5BaRKzhimKrOJB4LUES24ltjo+5v5GmZzYQKBgQDSbhiNQpmhOk4ICzwJ\n8DMCAigaDm2cD/qC66OFrHhQfr7EC9MRKKC/8WlZYgNepxZ1ZM95+GJu5aTsh7d2\nHknwJkxkbTadfRcch9HQun68Y814G0LBDuDRRc9OnBQW6Gr4jTFDP+uqQl6gAfu4\nQOjATymrRa5S/21MkQ3Ryb5H4QKBgQC6DI1ETmfvXCOVpEUM9IjeEbiAjVYbUjBL\nGEOhE0izOv8mjSEgifMSEXJMn58F4nW/UoxtDobTAhQ/WO5BUVCEeQnOAXhV57jU\n/t/fBbdC7nrVnfFl9KmsOV3LcxUo0yE/x7UiHd1QlwtOTl1KPFQa9WpSehxjjQAS\nmHYM5PhJnQKBgQCIGHCEm/hkkCL7jNiNzO4QdHifMYmuj58DoYcm4z8FQJP8k3E0\n/cPJoEb0ajGnvAUIc+TEC+MNujSKTdRX7or/aKWrpf7WqJqT9zu59YQWL64p6eeo\nmQjKEI5dVxCfKD5W9mpQBj1S5o3wipfUuRZPmmNmxDBUuaJlDMOVVRddwQKBgCUl\nbmst8GiFEAHHq5W7mTwlc54PGhsYXNYRgSc+72wBooHy+aNCh8qauyR7VkfZgELz\n21/G37pvltVTDzbxYk8gz4lXF8ynGGtGfDJONNnjPZk7EMCXiez+AzEkyBu/k8rl\nN9AZAGAf2D0JPm0dAHnleBYBlXt24oXT9PX8HWqtAoGBALRX6V1U+bKwMih3N21b\n1w/ELI7L1BBAPqJxiQPSOa7kshamZgFenbH1wFLIXz6YwaEOOmYiId6lFjcJaBbF\n+R4HfxBhOuY6cvD0vEROIRntaqsj4zJXahlZZ9uG1EAYrY2tGKkCUMKN2IBE+WWS\n3YTH4WIOsCZriuaHIAyjsCcv\n-----END PRIVATE KEY-----\n```\n\n\u003c/details\u003e\n\nExpected behavior: The client will fail to establish the connection.\n\nActual behavior: The client succeeds in establishing the connection.\n\n### Impact\n\nXray-core from v26.1.13 to the latest version",
"id": "GHSA-5wf9-h793-w73c",
"modified": "2026-10-02T22:35:51Z",
"published": "2026-10-02T22:35:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/XTLS/Xray-core/security/advisories/GHSA-5wf9-h793-w73c"
},
{
"type": "WEB",
"url": "https://github.com/XTLS/Xray-core/pull/6472"
},
{
"type": "WEB",
"url": "https://github.com/XTLS/Xray-core/commit/64fada32b5b9e6ae064a038fa0e4e2b766499bd5"
},
{
"type": "PACKAGE",
"url": "https://github.com/XTLS/Xray-core"
},
{
"type": "WEB",
"url": "https://github.com/XTLS/Xray-core/releases/tag/v26.7.11"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks"
}
GHSA-6486-8HJQ-Q8VF
Vulnerability from github – Published: 2026-08-05 18:31 – Updated: 2026-08-05 18:31
VLAI
Details
IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow fails to properly verify that the hostname matches the server certificate potentially allowing connections to an attacker-controlled server.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-12730"
],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-05T16:16:49Z",
"severity": "LOW"
},
"details": "IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow fails to properly verify that the hostname matches the server certificate potentially allowing connections to an attacker-controlled server.",
"id": "GHSA-6486-8hjq-q8vf",
"modified": "2026-08-05T18:31:35Z",
"published": "2026-08-05T18:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12730"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7282596"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-67FW-W8F2-88WP
Vulnerability from github – Published: 2024-08-01 18:32 – Updated: 2024-08-16 18:39
VLAI
Summary
casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification
Details
An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/casdoor/casdoor"
},
"ranges": [
{
"events": [
{
"introduced": "1.541.0"
},
{
"last_affected": "1.636.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-41264"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-295",
"CWE-297"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-02T13:29:15Z",
"nvd_published_at": "2024-08-01T16:15:06Z",
"severity": "MODERATE"
},
"details": "An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the `ssh.InsecureIgnoreHostKey()` method.",
"id": "GHSA-67fw-w8f2-88wp",
"modified": "2024-08-16T18:39:40Z",
"published": "2024-08-01T18:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41264"
},
{
"type": "WEB",
"url": "https://gist.github.com/nyxfqq/33ceaccbc9b05d439a944c2b55fa1c0f"
},
{
"type": "PACKAGE",
"url": "https://github.com/casdoor/casdoor"
},
{
"type": "WEB",
"url": "https://github.com/casdoor/casdoor/blob/v1.636.0/object/viaSSHDialer.go"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2024-3026"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "casdoor\u0027s use of`ssh.InsecureIgnoreHostKey()` disables host key verification"
}
Mitigation
Architecture and Design
Fully check the hostname of the certificate and provide the user with adequate information about the nature of the problem and how to proceed.
Mitigation
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
No CAPEC attack patterns related to this CWE.