PULSE
EN
FEED
ransombooba project reclama a LifeFone · US · Healthcareransombooba project reclama a National Association of Credit Management · US · Financial Servicesransombooba project reclama a California School Boards Association · US · Educationransombooba project reclama a South Weber City · US · Government & Defenseransombooba project reclama a Programs for Parents, Inc. · US · Educationransombooba project reclama a Circleville Police Department · US · Government & Defenseransomemperador reclama a MAA Group Consulting Engineers · Professional Servicesransomrhysida reclama a ClaimTek Systems · Financial Servicesransomlockbit5 reclama a xspringcapital.com · SG · Financial Servicesransomlockbit5 reclama a susannecerda.com · MXransomanubis reclama a Santiam Hospital & Clinics · US · Healthcareransomsilentransomgroup reclama a Lowenstein Sandler LLP · US · Professional Servicesransompear reclama a Cyrious Software · US · Technologyransomwallstreet reclama a Fortrex · US · Manufacturingransombooba project reclama a LifeFone · US · Healthcareransombooba project reclama a National Association of Credit Management · US · Financial Servicesransombooba project reclama a California School Boards Association · US · Educationransombooba project reclama a South Weber City · US · Government & Defenseransombooba project reclama a Programs for Parents, Inc. · US · Educationransombooba project reclama a Circleville Police Department · US · Government & Defenseransomemperador reclama a MAA Group Consulting Engineers · Professional Servicesransomrhysida reclama a ClaimTek Systems · Financial Servicesransomlockbit5 reclama a xspringcapital.com · SG · Financial Servicesransomlockbit5 reclama a susannecerda.com · MXransomanubis reclama a Santiam Hospital & Clinics · US · Healthcareransomsilentransomgroup reclama a Lowenstein Sandler LLP · US · Professional Servicesransompear reclama a Cyrious Software · US · Technologyransomwallstreet reclama a Fortrex · US · Manufacturing
← Todos los CVEs
CVE Watch26 oct 2026

CVE-2026-66392

Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the c

CVSS

—

Sin CVSS

EPSS

0.1%

p1

KEV

—

Exploit Today

0

0-100

Publicado: 21 oct 2026 · Última mod.: 26 oct 2026 · CWE-297

EPSS · 30d
0.1%EPSS · 30 días0.1%
2026-10-222026-10-28
Descripción técnica

Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or IP address. A network attacker who can redirect or intercept a connection and who possesses a certificate issued by a CA trusted by the client for another name may impersonate the requested TLS endpoint. Affected Scenarios: Applications use a bRPC client Channel to connect to an untrusted network with certificate verification enabled and trust a CA that can issue certificates for identities other than the intended endpoint. How to Fix: Upgrade to Apache bRPC 1.18.0 and enable VERIFY_PEER with a positive verify_depth. HTTPS Channels automatically verify the certificate against the host in the Channel URL. Callers may set VerifyOptions::expected_peer_name explicitly when the certificate identity differs from the URL host. Alternatively, apply the patch from https://github.com/apache/brpc/pull/3408 . Note: The new option performs DNS SAN or IP SAN verification during the TLS handshake. Configurations that set expected_peer_name while peer verification is disabled are rejected.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-859747.4 ALT
3.2%
——1Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. A network-positioned attacker could exploit this weakness to intercept or modify communications with an affected service.14dCVE-2026-1078195.9 MED
28.1%
——8MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.16dCVE-2026-1079389.1 CRÍ
9.1%
——3In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The certificate chain was validated against the configured trust store, but the endpoint’s identity was not. A network attacker able to intercept traffic could present any certificate trusted by the client, such as a publicly issued certificate for a domain they control, and impersonate the target service. They could then read or modify the exchanged messages, including credentials.  Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.13dCVE-2026-886476.5 MED
10.8%
——3A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.10dCVE-2026-1076604.8 MED
3.0%
——1FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.15dCVE-2026-85088—
6.4%
——2Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the host name that was connected to. That comparison walks the subjectAltName dNSName entries first and consults the certificate Common Name afterwards. A name that does not match yields a "skip" result rather than a rejection, so a certificate whose subjectAltName entries are all present and all non-matching falls through to the Common Name, which can then satisfy the check. RFC 6125 section 6.4.4, and RFC 9525 section 2, require that the Common Name is not consulted when a dNSName subjectAltName is present. A certificate carrying subjectAltName entries for one name and a Common Name for another is therefore accepted for a connection to the second name. Exploitation requires an attacker positioned on the network path who holds a certificate that chains to a certificate authority in the client's trust store and whose Common Name matches the connected host name. Public certificate authorities have not issued on Common Name alone for many years, so this is principally a concern for deployments using a private or enterprise public-key infrastructure. This issue affects the C++ library of Apache Thrift from 0.7.0 through 0.24.0 and the D library from 0.9.0 through 0.24.0. Users should upgrade to 0.25.0.27d