https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 11 Sep 2026 13:26:07 +0000 https://vulnerability.circl.lu/sighting/6f6122ca-bb99-4be4-8524-7fd1ebc02a8b/export {"uuid": "6f6122ca-bb99-4be4-8524-7fd1ebc02a8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34181", "type": "seen", "source": "https://gist.github.com/alon710/2b9e0ac9d204b77b1b6db1f2d326bdfa", "content": "# GHSA-MPWR-8VM7-H73F: GHSA-mpwr-8vm7-h73f: Key Space Collapse and Authentication Bypass in go-pkcs12 PBMAC1 Decoding\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-08-17\n> **Full Report:** https://cvereports.com/reports/GHSA-MPWR-8VM7-H73F\n\n## Summary\nA security vulnerability in the Go library software.sslmate.com/src/go-pkcs12 allows remote attackers to bypass password-based integrity verification. By crafting a PKCS#12 file with an excessively short KeyLength parameter in the PBMAC1 configuration, the derived MAC key space collapses, allowing an attacker to forge arbitrary certificate structures and private keys that are incorrectly verified as valid.\n\n## TL;DR\nAn authentication and integrity bypass flaw in go-pkcs12 allows attackers to forge PKCS#12 files by configuring a 1-byte PBMAC1 key length, collapsing the validation keyspace to 256 possibilities.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-354\n- **Attack Vector**: Network\n- **CVSS v3.1 Severity**: 7.4 (High)\n- **EPSS Score**: 0.00235\n- **Exploit Status**: Proof of Concept / Theoretical\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- software.sslmate.com/src/go-pkcs12\n- **go-pkcs12**: >= 0.6.0, < 0.7.2 (Fixed in: `0.7.2`)\n\n## Mitigation\n\n- Upgrade the go-pkcs12 dependency to version v0.7.2 or higher.\n- Implement client-side or boundary checks to inspect the ASN.1 structure of PKCS#12 containers before processing.\n- Enforce API rate-limiting on endpoints that ingest and parse PKCS#12 files to mitigate multi-attempt brute-force attacks.\n\n**Remediation Steps:**\n1. Open your Go project's terminal.\n2. Run the command: `go get -u software.sslmate.com/src/go-pkcs12@v0.7.2`\n3. Execute `go mod tidy` to clean up dependencies and update the `go.sum` file.\n4. Verify deployment using `govulncheck ./...` to confirm the vulnerability is no longer reported.\n\n## References\n\n- [GitHub Advisory GHSA-mpwr-8vm7-h73f](https://github.com/advisories/GHSA-mpwr-8vm7-h73f)\n- [SSLMate Security Advisory](https://github.com/SSLMate/go-pkcs12/security/advisories/GHSA-mpwr-8vm7-h73f)\n- [Fix Commit 03c441f6b0267f695ca02464133c0b373bf4dd55](https://github.com/SSLMate/go-pkcs12/commit/03c441f6b0267f695ca02464133c0b373bf4dd55)\n- [OpenSSL Security Advisory (2026-06-09)](https://openssl-library.org/news/secadv/20260609.txt)\n- [OpenSSL Vulnerability CVE-2026-34181](https://openssl-library.org/news/vulnerabilities/#CVE-2026-34181)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-MPWR-8VM7-H73F) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-18T06:31:46.876112Z"} {"uuid": "6f6122ca-bb99-4be4-8524-7fd1ebc02a8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34181", "type": "seen", "source": "https://gist.github.com/alon710/2b9e0ac9d204b77b1b6db1f2d326bdfa", "content": "# GHSA-MPWR-8VM7-H73F: GHSA-mpwr-8vm7-h73f: Key Space Collapse and Authentication Bypass in go-pkcs12 PBMAC1 Decoding\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-08-17\n> **Full Report:** https://cvereports.com/reports/GHSA-MPWR-8VM7-H73F\n\n## Summary\nA security vulnerability in the Go library software.sslmate.com/src/go-pkcs12 allows remote attackers to bypass password-based integrity verification. By crafting a PKCS#12 file with an excessively short KeyLength parameter in the PBMAC1 configuration, the derived MAC key space collapses, allowing an attacker to forge arbitrary certificate structures and private keys that are incorrectly verified as valid.\n\n## TL;DR\nAn authentication and integrity bypass flaw in go-pkcs12 allows attackers to forge PKCS#12 files by configuring a 1-byte PBMAC1 key length, collapsing the validation keyspace to 256 possibilities.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-354\n- **Attack Vector**: Network\n- **CVSS v3.1 Severity**: 7.4 (High)\n- **EPSS Score**: 0.00235\n- **Exploit Status**: Proof of Concept / Theoretical\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- software.sslmate.com/src/go-pkcs12\n- **go-pkcs12**: >= 0.6.0, < 0.7.2 (Fixed in: `0.7.2`)\n\n## Mitigation\n\n- Upgrade the go-pkcs12 dependency to version v0.7.2 or higher.\n- Implement client-side or boundary checks to inspect the ASN.1 structure of PKCS#12 containers before processing.\n- Enforce API rate-limiting on endpoints that ingest and parse PKCS#12 files to mitigate multi-attempt brute-force attacks.\n\n**Remediation Steps:**\n1. Open your Go project's terminal.\n2. Run the command: `go get -u software.sslmate.com/src/go-pkcs12@v0.7.2`\n3. Execute `go mod tidy` to clean up dependencies and update the `go.sum` file.\n4. Verify deployment using `govulncheck ./...` to confirm the vulnerability is no longer reported.\n\n## References\n\n- [GitHub Advisory GHSA-mpwr-8vm7-h73f](https://github.com/advisories/GHSA-mpwr-8vm7-h73f)\n- [SSLMate Security Advisory](https://github.com/SSLMate/go-pkcs12/security/advisories/GHSA-mpwr-8vm7-h73f)\n- [Fix Commit 03c441f6b0267f695ca02464133c0b373bf4dd55](https://github.com/SSLMate/go-pkcs12/commit/03c441f6b0267f695ca02464133c0b373bf4dd55)\n- [OpenSSL Security Advisory (2026-06-09)](https://openssl-library.org/news/secadv/20260609.txt)\n- [OpenSSL Vulnerability CVE-2026-34181](https://openssl-library.org/news/vulnerabilities/#CVE-2026-34181)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-MPWR-8VM7-H73F) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-18T06:31:46.876112Z"} https://vulnerability.circl.lu/sighting/6f6122ca-bb99-4be4-8524-7fd1ebc02a8b/export Tue, 18 Aug 2026 06:31:46 +0000 https://vulnerability.circl.lu/sighting/fd9d88b0-bab4-40cc-8c86-26c4b9f83f1b/export {"uuid": "fd9d88b0-bab4-40cc-8c86-26c4b9f83f1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3418", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mshcuo2pnf2j", "content": "One Broken REST API, One More Cathedral of Bad Decisions\nPANIC 72% | Lag 0.0h | CVE-2026-3418 lets an attacker with administrative access abuse the System REST API to upload malici\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-08-07T00:38:31.975024Z"} {"uuid": "fd9d88b0-bab4-40cc-8c86-26c4b9f83f1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3418", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mshcuo2pnf2j", "content": "One Broken REST API, One More Cathedral of Bad Decisions\nPANIC 72% | Lag 0.0h | CVE-2026-3418 lets an attacker with administrative access abuse the System REST API to upload malici\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-08-07T00:38:31.975024Z"} https://vulnerability.circl.lu/sighting/fd9d88b0-bab4-40cc-8c86-26c4b9f83f1b/export Fri, 07 Aug 2026 00:38:31 +0000 https://vulnerability.circl.lu/sighting/dbe1da3e-1273-47fc-b25b-cc202295143e/export {"uuid": "dbe1da3e-1273-47fc-b25b-cc202295143e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-34182", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-028", "content": "", "creation_timestamp": "2026-07-01T02:45:05.098473Z"} {"uuid": "dbe1da3e-1273-47fc-b25b-cc202295143e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-34182", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-028", "content": "", "creation_timestamp": "2026-07-01T02:45:05.098473Z"} https://vulnerability.circl.lu/sighting/dbe1da3e-1273-47fc-b25b-cc202295143e/export Wed, 01 Jul 2026 02:45:05 +0000 https://vulnerability.circl.lu/sighting/56b35b77-1585-4e19-9fed-3a293e6618f2/export {"uuid": "56b35b77-1585-4e19-9fed-3a293e6618f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34183", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbz3y7k5q2v", "content": "CVE-2026-34183: Panic Over Memory Gremlins or Just Another Buzzword?", "creation_timestamp": "2026-06-27T17:43:39.679026Z"} {"uuid": "56b35b77-1585-4e19-9fed-3a293e6618f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34183", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbz3y7k5q2v", "content": "CVE-2026-34183: Panic Over Memory Gremlins or Just Another Buzzword?", "creation_timestamp": "2026-06-27T17:43:39.679026Z"} https://vulnerability.circl.lu/sighting/56b35b77-1585-4e19-9fed-3a293e6618f2/export Sat, 27 Jun 2026 17:43:39 +0000 https://vulnerability.circl.lu/sighting/8a1f22e8-dc1e-4b9e-9bea-e5e4e393d203/export {"uuid": "8a1f22e8-dc1e-4b9e-9bea-e5e4e393d203", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34183", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbz3xsrxh2d", "content": "CVE-2026-34183: A Critical Wake-up Call for QUIC Protocol Accountability", "creation_timestamp": "2026-06-27T17:43:39.045398Z"} {"uuid": "8a1f22e8-dc1e-4b9e-9bea-e5e4e393d203", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34183", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbz3xsrxh2d", "content": "CVE-2026-34183: A Critical Wake-up Call for QUIC Protocol Accountability", "creation_timestamp": "2026-06-27T17:43:39.045398Z"} https://vulnerability.circl.lu/sighting/8a1f22e8-dc1e-4b9e-9bea-e5e4e393d203/export Sat, 27 Jun 2026 17:43:39 +0000 https://vulnerability.circl.lu/sighting/f09f3d6c-f96b-4a0b-83b4-9f88c0777be4/export {"uuid": "f09f3d6c-f96b-4a0b-83b4-9f88c0777be4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34183", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbz3xfz522o", "content": "Unraveling CVE-2026-34183: Whose Interests Lie Beneath the QUIC Vulnerability?", "creation_timestamp": "2026-06-27T17:43:38.446741Z"} {"uuid": "f09f3d6c-f96b-4a0b-83b4-9f88c0777be4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34183", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbz3xfz522o", "content": "Unraveling CVE-2026-34183: Whose Interests Lie Beneath the QUIC Vulnerability?", "creation_timestamp": "2026-06-27T17:43:38.446741Z"} https://vulnerability.circl.lu/sighting/f09f3d6c-f96b-4a0b-83b4-9f88c0777be4/export Sat, 27 Jun 2026 17:43:38 +0000 https://vulnerability.circl.lu/sighting/b3586dca-1d31-4f34-838c-b7aa4dcb5fd8/export {"uuid": "b3586dca-1d31-4f34-838c-b7aa4dcb5fd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34183", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbz3wzjqb2o", "content": "The Path to Memory Exploitation: CVE-2026-34183 Exposes QUIC Vulnerability", "creation_timestamp": "2026-06-27T17:43:37.831970Z"} {"uuid": "b3586dca-1d31-4f34-838c-b7aa4dcb5fd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34183", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbz3wzjqb2o", "content": "The Path to Memory Exploitation: CVE-2026-34183 Exposes QUIC Vulnerability", "creation_timestamp": "2026-06-27T17:43:37.831970Z"} https://vulnerability.circl.lu/sighting/b3586dca-1d31-4f34-838c-b7aa4dcb5fd8/export Sat, 27 Jun 2026 17:43:37 +0000 https://vulnerability.circl.lu/sighting/748cf596-4a9a-4c8c-a090-f4c8ccd27b6d/export {"uuid": "748cf596-4a9a-4c8c-a090-f4c8ccd27b6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34183", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbz3wdj6v2b", "content": "CVE-2026-34183: Panic Over Memory Gremlins or Just Another Buzzword?", "creation_timestamp": "2026-06-27T17:43:37.219311Z"} {"uuid": "748cf596-4a9a-4c8c-a090-f4c8ccd27b6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34183", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbz3wdj6v2b", "content": "CVE-2026-34183: Panic Over Memory Gremlins or Just Another Buzzword?", "creation_timestamp": "2026-06-27T17:43:37.219311Z"} https://vulnerability.circl.lu/sighting/748cf596-4a9a-4c8c-a090-f4c8ccd27b6d/export Sat, 27 Jun 2026 17:43:37 +0000 https://vulnerability.circl.lu/sighting/63bab6e0-8b76-4958-83ba-3fbd33ebdfaf/export {"uuid": "63bab6e0-8b76-4958-83ba-3fbd33ebdfaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34183", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbz3vw7hy2v", "content": "CVE-2026-34183: A Critical Wake-up Call for QUIC Protocol Accountability", "creation_timestamp": "2026-06-27T17:43:36.603123Z"} {"uuid": "63bab6e0-8b76-4958-83ba-3fbd33ebdfaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34183", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbz3vw7hy2v", "content": "CVE-2026-34183: A Critical Wake-up Call for QUIC Protocol Accountability", "creation_timestamp": "2026-06-27T17:43:36.603123Z"} https://vulnerability.circl.lu/sighting/63bab6e0-8b76-4958-83ba-3fbd33ebdfaf/export Sat, 27 Jun 2026 17:43:36 +0000 https://vulnerability.circl.lu/sighting/cdc250cf-ff09-4e73-a265-831fde83c822/export {"uuid": "cdc250cf-ff09-4e73-a265-831fde83c822", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34183", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbz3viq2a2c", "content": "Unraveling CVE-2026-34183: Whose Interests Lie Beneath the QUIC Vulnerability?", "creation_timestamp": "2026-06-27T17:43:35.954395Z"} {"uuid": "cdc250cf-ff09-4e73-a265-831fde83c822", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34183", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbz3viq2a2c", "content": "Unraveling CVE-2026-34183: Whose Interests Lie Beneath the QUIC Vulnerability?", "creation_timestamp": "2026-06-27T17:43:35.954395Z"} https://vulnerability.circl.lu/sighting/cdc250cf-ff09-4e73-a265-831fde83c822/export Sat, 27 Jun 2026 17:43:35 +0000