aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Aria2 Project |
|
No data.
No data.
References
| Link | Providers |
|---|---|
| https://www.tenable.com/security/research/tra-2026-38 |
|
History
Thu, 14 May 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Aria2 Project
Aria2 Project aria2 |
|
| Vendors & Products |
Aria2 Project
Aria2 Project aria2 |
Wed, 13 May 2026 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication. | |
| Title | aria2c Improper Certificate Validation | |
| Weaknesses | CWE-295 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: tenable
Published:
Updated: 2026-05-13T18:35:03.804Z
Reserved: 2026-05-11T20:46:54.600Z
Link: CVE-2026-8367
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-05-13T16:17:04.780
Modified: 2026-05-13T16:27:11.127
Link: CVE-2026-8367
Redhat
No data.