CWE-436

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "crass",
          "vendor": "rgrove",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T20:10:34.010Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rgrove/crass/security/advisories/GHSA-pq4g-8rxf-4g29",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rgrove/crass/security/advisories/GHSA-pq4g-8rxf-4g29"
        },
        {
          "name": "https://github.com/rgrove/crass/commit/689fc45c632fdf3803b2f4e844ffc9cca3b08f34",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rgrove/crass/commit/689fc45c632fdf3803b2f4e844ffc9cca3b08f34"
        },
        {
          "name": "https://github.com/rgrove/crass/releases/tag/v1.0.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rgrove/crass/releases/tag/v1.0.8"
        }
      ],
      "source": {
        "advisory": "GHSA-pq4g-8rxf-4g29",
        "discovery": "UNKNOWN"
      },
      "title": "Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-116695",
    "datePublished": "2026-10-27T20:10:34.010Z",
    "dateReserved": "2026-10-26T20:00:59.831Z",
    "dateUpdated": "2026-10-27T20:10:34.010Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "MIME::Field::ParamVal"
          ],
          "packageName": "MIME-tools",
          "packageURL": "pkg:cpan/MIME-tools",
          "programFiles": [
            "lib/MIME/Field/ParamVal.pm"
          ],
          "programRoutines": [
            {
              "name": "MIME::Field::ParamVal::parse_params"
            }
          ],
          "repo": "https://salsa.debian.org/dskoll/mime-tools",
          "versions": [
            {
              "lessThan": "5.521",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment.\n\nA parameter written boundary((c))=\"A\" or boundary(\\))=\"A\" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a duplicate, and MIME::Parser splits the message on it.\n\nReaders that skip comments as RFC 5322 allows take the first boundary instead. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient\u0027s mail client shows it."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436 Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T17:34:25.862Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to MIME-tools 5.521 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-116272",
    "datePublished": "2026-10-28T17:34:25.862Z",
    "dateReserved": "2026-10-25T18:05:02.236Z",
    "dateUpdated": "2026-10-28T17:34:25.862Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "MIME::Field::ParamVal"
          ],
          "packageName": "MIME-tools",
          "packageURL": "pkg:cpan/MIME-tools",
          "programFiles": [
            "lib/MIME/Field/ParamVal.pm",
            "lib/MIME/WordDecoder.pm",
            "lib/MIME/Head.pm"
          ],
          "programRoutines": [
            {
              "name": "MIME::Field::ParamVal::parse_params"
            },
            {
              "name": "MIME::WordDecoder::decode"
            },
            {
              "name": "MIME::Head::recommended_filename"
            }
          ],
          "repo": "https://salsa.debian.org/dskoll/mime-tools",
          "versions": [
            {
              "lessThan": "5.521",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename.\n\nA parameter such as filename*=utf-8\u0027en-US\u0027payload.exe is converted to an encoded word with the language tag appended to the charset. The decoder strips the language suffix only when it is a single word, so it cannot resolve the charset UTF-8*EN-US and returns an empty string. The recommended_filename() method returns that empty string rather than falling back to the name parameter.\n\nOther mail readers return payload.exe. A remote sender can get an attachment past a policy that checks file extensions on the recommended filename."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436 Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T17:33:22.332Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to MIME-tools 5.521 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-116269",
    "datePublished": "2026-10-28T17:33:22.332Z",
    "dateReserved": "2026-10-25T18:05:02.236Z",
    "dateUpdated": "2026-10-28T17:33:22.332Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "MIME::Head"
          ],
          "packageName": "MIME-tools",
          "packageURL": "pkg:cpan/MIME-tools",
          "programFiles": [
            "lib/MIME/Head.pm",
            "lib/MIME/Field/ParamVal.pm"
          ],
          "programRoutines": [
            {
              "name": "MIME::Head::multipart_boundary"
            },
            {
              "name": "MIME::Field::ParamVal::parse_params"
            }
          ],
          "repo": "https://salsa.debian.org/dskoll/mime-tools",
          "versions": [
            {
              "lessThan": "5.521",
              "status": "affected",
              "version": "5.518",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous.\n\nThe multipart_boundary() method decodes RFC 2047 encoded words anywhere in the boundary, but the ambiguity check only fires when the whole value is one encoded word. A boundary such as abc=?us-ascii?Q?def?= is used as abcdef, and ambiguous_content() returns false.\n\nEncoded words are not allowed in parameters, so other mail readers split the message on the literal value. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient\u0027s mail client shows it."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436 Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T17:32:28.565Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to MIME-tools 5.521 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-116266",
    "datePublished": "2026-10-28T17:32:28.565Z",
    "dateReserved": "2026-10-25T18:05:02.235Z",
    "dateUpdated": "2026-10-28T17:32:28.565Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "MIME::Field::ParamVal"
          ],
          "packageName": "MIME-tools",
          "packageURL": "pkg:cpan/MIME-tools",
          "programFiles": [
            "lib/MIME/Field/ParamVal.pm"
          ],
          "programRoutines": [
            {
              "name": "MIME::Field::ParamVal::parse_params"
            }
          ],
          "repo": "https://salsa.debian.org/dskoll/mime-tools",
          "versions": [
            {
              "lessThan": "5.521",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations.\n\nThe boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections (boundary*0=, boundary*1= and so on) is joined after they have run. A repeated section number is concatenated rather than reported as a duplicate. From version 5.518, an encoded word or trailing whitespace in such a boundary also goes unflagged, although multipart_boundary() decodes or strips it.\n\nA remote sender can make MIME::Parser split a message on a different boundary than other mail readers, hiding an attachment from a filter that relies on ambiguous_content() while the recipient\u0027s mail client shows it."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436 Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T17:32:11.827Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to MIME-tools 5.521 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-116265",
    "datePublished": "2026-10-28T17:32:11.827Z",
    "dateReserved": "2026-10-25T18:05:02.235Z",
    "dateUpdated": "2026-10-28T17:32:11.827Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "MIME::Field::ParamVal"
          ],
          "packageName": "MIME-tools",
          "packageURL": "pkg:cpan/MIME-tools",
          "programFiles": [
            "lib/MIME/Field/ParamVal.pm"
          ],
          "programRoutines": [
            {
              "name": "MIME::Field::ParamVal::parse_params"
            }
          ],
          "repo": "https://salsa.debian.org/dskoll/mime-tools",
          "versions": [
            {
              "lessThan": "5.521",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary.\n\nParameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops every parameter after it. When the boundary is among them, MIME::Parser keeps the multipart body as a single undecoded part without marking the parse as ambiguous.\n\nMail readers that skip the invalid parameter still find the boundary. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient\u0027s mail client shows it."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436 Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T17:31:52.187Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to MIME-tools 5.521 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-116264",
    "datePublished": "2026-10-28T17:31:52.187Z",
    "dateReserved": "2026-10-25T18:05:02.235Z",
    "dateUpdated": "2026-10-28T17:31:52.187Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/adm-zip",
          "product": "adm-zip",
          "vendor": "cthackers",
          "versions": [
            {
              "lessThanOrEqual": "0.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:adm-zip_project:adm-zip:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Arjun Jain"
        }
      ],
      "datePublic": "2026-10-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like \u0027./hello.txt\u0027 and \u0027hello.txt\u0027. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-25T11:51:01.980Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #587",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/cthackers/adm-zip/issues/587"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/cthackers/adm-zip"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/zipFile.js#L81-L92"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/adm-zip.js#L87"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/util/utils.js#L383"
        },
        {
          "name": "VulnCheck Advisory: adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/adm-zip-through-0.6.1-duplicate-entry-validation-bypass-via-canonically-equivalent-names"
        }
      ],
      "title": "adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116137",
    "datePublished": "2026-10-25T11:51:01.980Z",
    "dateReserved": "2026-10-25T11:15:17.810Z",
    "dateUpdated": "2026-10-25T11:51:01.980Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "zip2",
          "vendor": "zip-rs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T16:24:44.760Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj"
        },
        {
          "name": "https://github.com/zip-rs/zip2/commit/8068ab480ccf8daa7411424e365fcdbe6d09443e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zip-rs/zip2/commit/8068ab480ccf8daa7411424e365fcdbe6d09443e"
        },
        {
          "name": "https://github.com/zip-rs/zip2/releases/tag/v9.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zip-rs/zip2/releases/tag/v9.0.5"
        }
      ],
      "source": {
        "advisory": "GHSA-m665-v7pm-7grj",
        "discovery": "UNKNOWN"
      },
      "title": "zip: Critical Parser Differential \u0026 Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite \u0026 RCE"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-115905",
    "datePublished": "2026-10-26T16:24:44.760Z",
    "dateReserved": "2026-10-23T20:21:45.106Z",
    "dateUpdated": "2026-10-26T16:24:44.760Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "hackney_url"
          ],
          "packageName": "hackney",
          "packageURL": "pkg:hex/hackney",
          "product": "hackney",
          "programFiles": [
            "src/hackney_url.erl"
          ],
          "programRoutines": [
            {
              "name": "hackney_url:normalize/2"
            }
          ],
          "repo": "https://github.com/benoitc/hackney",
          "vendor": "benoitc",
          "versions": [
            {
              "lessThan": "4.9.0",
              "status": "affected",
              "version": "4.0.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "hackney_url"
          ],
          "packageName": "benoitc/hackney",
          "packageURL": "pkg:github/benoitc/hackney",
          "product": "hackney",
          "programFiles": [
            "src/hackney_url.erl"
          ],
          "programRoutines": [
            {
              "name": "hackney_url:normalize/2"
            }
          ],
          "repo": "https://github.com/benoitc/hackney",
          "vendor": "benoitc",
          "versions": [
            {
              "lessThan": "f19561a0b422376348c91537e51377ab7325f4ee",
              "status": "affected",
              "version": "452620a92ec1da2e6b4862a049a2a4f04b42068f",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe application passes URLs that an untrusted party can influence to hackney and relies on its own host allowlist, built on \u003ccode\u003euri_string:parse/1\u003c/code\u003e or \u003ccode\u003einet:parse_address/1\u003c/code\u003e, to keep requests away from internal addresses.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The application passes URLs that an untrusted party can influence to hackney and relies on its own host allowlist, built on `uri_string:parse/1` or `inet:parse_address/1`, to keep requests away from internal addresses."
            }
          ],
          "value": "The application passes URLs that an untrusted party can influence to hackney and relies on its own host allowlist, built on uri_string:parse/1 or inet:parse_address/1, to keep requests away from internal addresses."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.0",
                  "versionStartIncluding": "4.0.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eurico Nicacio"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Eurico Nicacio"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Benoit Chesneau"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-10-26T10:12:09.000Z",
      "datePublic": "2026-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInterpretation Conflict vulnerability in \u003ccode\u003ehackney_url\u003c/code\u003e in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as \u003ccode\u003e%5B%3A%3Affff%3A127%2E0%2E0%2E1%5D\u003c/code\u003e (decoding to \u003ccode\u003e[::ffff:127.0.0.1]\u003c/code\u003e) or \u003ccode\u003e127.0.0.1.\u003c/code\u003e is not an IP address to a caller\u0027s allowlist built on \u003ccode\u003euri_string:parse/1\u003c/code\u003e and \u003ccode\u003einet:parse_address/1\u003c/code\u003e, while hackney connects to the address it denotes. The same applies to a \u003ccode\u003eLocation\u003c/code\u003e target when redirects are followed.\u003c/p\u003e\n\u003cp\u003eThe IP-literal gate that \u003ccode\u003ehackney_url:normalize/2\u003c/code\u003e applies to a percent-decoded host, added to close the percent-encoded IP bypass of CVE-2026-47076, passes the decoded value to \u003ccode\u003einet_parse:address/1\u003c/code\u003e as is. The connect path in \u003ccode\u003ehackney_happy:parse_address/1\u003c/code\u003e drops a surrounding bracket pair, and the resolver ignores a trailing dot, so both forms pass the gate and still reach the literal address. Domain names with a trailing dot and unencoded IPv6 literals are not affected.\u003c/p\u003e\n\u003cp\u003eThis issue affects hackney: from 4.0.1 before 4.9.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Interpretation Conflict vulnerability in `hackney_url` in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as `%5B%3A%3Affff%3A127%2E0%2E0%2E1%5D` (decoding to `[::ffff:127.0.0.1]`) or `127.0.0.1.` is not an IP address to a caller\u0027s allowlist built on `uri_string:parse/1` and `inet:parse_address/1`, while hackney connects to the address it denotes. The same applies to a `Location` target when redirects are followed.\n\nThe IP-literal gate that `hackney_url:normalize/2` applies to a percent-decoded host, added to close the percent-encoded IP bypass of CVE-2026-47076, passes the decoded value to `inet_parse:address/1` as is. The connect path in `hackney_happy:parse_address/1` drops a surrounding bracket pair, and the resolver ignores a trailing dot, so both forms pass the gate and still reach the literal address. Domain names with a trailing dot and unencoded IPv6 literals are not affected.\n\nThis issue affects hackney: from 4.0.1 before 4.9.0."
            }
          ],
          "value": "Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D (decoding to [::ffff:127.0.0.1]) or 127.0.0.1. is not an IP address to a caller\u0027s allowlist built on uri_string:parse/1 and inet:parse_address/1, while hackney connects to the address it denotes. The same applies to a Location target when redirects are followed.\n\nThe IP-literal gate that hackney_url:normalize/2 applies to a percent-decoded host, added to close the percent-encoded IP bypass of CVE-2026-47076, passes the decoded value to inet_parse:address/1 as is. The connect path in hackney_happy:parse_address/1 drops a surrounding bracket pair, and the resolver ignores a trailing dot, so both forms pass the gate and still reach the literal address. Domain names with a trailing dot and unencoded IPv6 literals are not affected.\n\nThis issue affects hackney: from 4.0.1 before 4.9.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn application that checks user-supplied URLs against an IP allowlist before handing them to hackney can be made to request loopback, link-local metadata and private-network addresses that the allowlist rejects when they are written plainly.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "An application that checks user-supplied URLs against an IP allowlist before handing them to hackney can be made to request loopback, link-local metadata and private-network addresses that the allowlist rejects when they are written plainly."
                }
              ],
              "value": "An application that checks user-supplied URLs against an IP allowlist before handing them to hackney can be made to request loopback, link-local metadata and private-network addresses that the allowlist rejects when they are written plainly."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436 Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:49:02.744Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "hackney 4.9.0 release notes",
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/benoitc/hackney/releases/tag/4.9.0"
        },
        {
          "name": "EEF CNA record for CVE-2026-115700",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-115700.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-115700",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-115700"
        },
        {
          "name": "Refuse bracketed and trailing-dot IP literals in normalize/2 (benoitc/hackney#987)",
          "tags": [
            "related"
          ],
          "url": "https://github.com/benoitc/hackney/pull/987"
        },
        {
          "name": "Introducing commit 452620a in benoitc/hackney",
          "tags": [
            "related"
          ],
          "url": "https://github.com/benoitc/hackney/commit/452620a92ec1da2e6b4862a049a2a4f04b42068f"
        },
        {
          "name": "Fix commit f19561a in benoitc/hackney",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/benoitc/hackney/commit/f19561a0b422376348c91537e51377ab7325f4ee"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRun the allowlist on the host that \u003ccode\u003ehackney_url:normalize/1\u003c/code\u003e returns for the parsed URL, and strip a surrounding bracket pair and a trailing dot from it before the IP check, so the check sees the same address the connect path uses.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Run the allowlist on the host that `hackney_url:normalize/1` returns for the parsed URL, and strip a surrounding bracket pair and a trailing dot from it before the IP check, so the check sees the same address the connect path uses."
            }
          ],
          "value": "Run the allowlist on the host that hackney_url:normalize/1 returns for the parsed URL, and strip a surrounding bracket pair and a trailing dot from it before the IP check, so the check sees the same address the connect path uses."
        }
      ],
      "x_technicalAnalysis": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003e1. The gate.\u003c/strong\u003e \u003ccode\u003ehackney_url:normalize/2\u003c/code\u003e in \u003ccode\u003esrc/hackney_url.erl\u003c/code\u003e percent-decodes a host that is not already an IP literal and raises \u003ccode\u003einvalid_url_host\u003c/code\u003e when \u003ccode\u003einet_parse:address/1\u003c/code\u003e accepts the decoded value. This closed the plain percent-encoded IP case.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. What the connect path accepts.\u003c/strong\u003e \u003ccode\u003ehackney_happy:parse_address/1\u003c/code\u003e removes a surrounding \u003ccode\u003e[...]\u003c/code\u003e pair before calling \u003ccode\u003einet:parse_address/1\u003c/code\u003e, and the resolver treats a trailing dot as the root label. Neither form is accepted by \u003ccode\u003einet_parse:address/1\u003c/code\u003e, so \u003ccode\u003e[::ffff:127.0.0.1]\u003c/code\u003e and \u003ccode\u003e127.0.0.1.\u003c/code\u003e pass the gate.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Result.\u003c/strong\u003e A percent-encoded bracketed IPv6 literal such as \u003ccode\u003e%5B%3A%3Affff%3A127%2E0%2E0%2E1%5D\u003c/code\u003e, or an IPv4 literal with a trailing dot, is not an IP address to a caller\u0027s check based on \u003ccode\u003euri_string:parse/1\u003c/code\u003e and \u003ccode\u003einet:parse_address/1\u003c/code\u003e, but hackney connects to the address it denotes. The same applies to a \u003ccode\u003eLocation\u003c/code\u003e target when redirects are followed. The fix strips one bracket pair and one trailing dot in \u003ccode\u003eip_candidate/1\u003c/code\u003e before the gate.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "**1. The gate.** `hackney_url:normalize/2` in `src/hackney_url.erl` percent-decodes a host that is not already an IP literal and raises `invalid_url_host` when `inet_parse:address/1` accepts the decoded value. This closed the plain percent-encoded IP case.\n\n**2. What the connect path accepts.** `hackney_happy:parse_address/1` removes a surrounding `[...]` pair before calling `inet:parse_address/1`, and the resolver treats a trailing dot as the root label. Neither form is accepted by `inet_parse:address/1`, so `[::ffff:127.0.0.1]` and `127.0.0.1.` pass the gate.\n\n**3. Result.** A percent-encoded bracketed IPv6 literal such as `%5B%3A%3Affff%3A127%2E0%2E0%2E1%5D`, or an IPv4 literal with a trailing dot, is not an IP address to a caller\u0027s check based on `uri_string:parse/1` and `inet:parse_address/1`, but hackney connects to the address it denotes. The same applies to a `Location` target when redirects are followed. The fix strips one bracket pair and one trailing dot in `ip_candidate/1` before the gate."
            }
          ],
          "value": "1. The gate. hackney_url:normalize/2 in src/hackney_url.erl percent-decodes a host that is not already an IP literal and raises invalid_url_host when inet_parse:address/1 accepts the decoded value. This closed the plain percent-encoded IP case.\n\n2. What the connect path accepts. hackney_happy:parse_address/1 removes a surrounding [...] pair before calling inet:parse_address/1, and the resolver treats a trailing dot as the root label. Neither form is accepted by inet_parse:address/1, so [::ffff:127.0.0.1] and 127.0.0.1. pass the gate.\n\n3. Result. A percent-encoded bracketed IPv6 literal such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D, or an IPv4 literal with a trailing dot, is not an IP address to a caller\u0027s check based on uri_string:parse/1 and inet:parse_address/1, but hackney connects to the address it denotes. The same applies to a Location target when redirects are followed. The fix strips one bracket pair and one trailing dot in ip_candidate/1 before the gate."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-115700",
    "datePublished": "2026-10-26T13:49:02.744Z",
    "dateReserved": "2026-10-25T17:30:02.231Z",
    "dateUpdated": "2026-10-26T13:49:02.744Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/traefik/traefik/v2",
          "product": "traefik",
          "vendor": "traefik",
          "versions": [
            {
              "lessThan": "2.11.58",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.11.58",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/traefik/traefik/v3",
          "product": "traefik",
          "vendor": "traefik",
          "versions": [
            {
              "lessThan": "3.7.13",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.7.13",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.11.58",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.7.13",
                  "versionStartIncluding": "3.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-10-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T01:43:42.056Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2272-4vv8-65ww)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/traefik/traefik/security/advisories/GHSA-2272-4vv8-65ww"
        },
        {
          "name": "VulnCheck Advisory: Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.13-mtls-bypass-via-negated-host-matcher"
        }
      ],
      "title": "Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114656",
    "datePublished": "2026-10-22T01:43:42.056Z",
    "dateReserved": "2026-10-21T21:59:05.256Z",
    "dateUpdated": "2026-10-22T01:43:42.056Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}