https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 03:40:43 +0000 https://vulnerability.circl.lu/vuln/cve-2026-33896 <p><strong>Affected:</strong> digitalbazaar forge, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Cluster Observability Operator 1.5.0, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9, Red Hat Cryostat 4, Red Hat Logging Subsystem for Red Hat OpenShift, Red Hat Ansible Automation Platform 2, Red Hat build of Apache Camel - HawtIO 4 and 9 more</p> <p>Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.</p> <p><strong>Affected:</strong> digitalbazaar forge, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Cluster Observability Operator 1.5.0, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9, Red Hat Cryostat 4, Red Hat Logging Subsystem for Red Hat OpenShift, Red Hat Ansible Automation Platform 2, Red Hat build of Apache Camel - HawtIO 4 and 9 more</p> <p>Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.</p> https://vulnerability.circl.lu/vuln/cve-2026-33896