CWE-354
AllowedImproper Validation of Integrity Check Value
Abstraction: Base · Status: Draft
The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
263 vulnerabilities reference this CWE, most recent first.
GHSA-6645-RFG8-RHRM
Vulnerability from github – Published: 2026-09-16 00:31 – Updated: 2026-09-16 00:31Netcore NR268 firmware version 1.7.121109 has an improper integrity verification flaw in mtd_write allowing forged firmware authenticity checks. Attackers can exploit put_file.cgi and check_image_uuid.c to bypass firmware signature validation and load unauthorized firmware images.
{
"affected": [],
"aliases": [
"CVE-2026-76852"
],
"database_specific": {
"cwe_ids": [
"CWE-354"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-15T22:16:58Z",
"severity": "HIGH"
},
"details": "Netcore NR268 firmware version 1.7.121109 has an improper integrity verification flaw in mtd_write allowing forged firmware authenticity checks. Attackers can exploit put_file.cgi and check_image_uuid.c to bypass firmware signature validation and load unauthorized firmware images.",
"id": "GHSA-6645-rfg8-rhrm",
"modified": "2026-09-16T00:31:29Z",
"published": "2026-09-16T00:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76852"
},
{
"type": "WEB",
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr268-firmware-forgery.md"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/netcore-nr268-1.7.121109-forgeable-firmware-authenticity-check-in-mtd-write"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-66X3-6CW3-V5GJ
Vulnerability from github – Published: 2022-05-24 20:50 – Updated: 2022-05-24 20:50Impact
go-tuf does not correctly implement the client workflow for updating the metadata files for roles other than the root role. Specifically, checks for rollback attacks are not implemented correctly meaning an attacker can cause clients to install software that is older than the software which the client previously knew to be available, and may include software with known vulnerabilities.
In more detail, the client code of go-tuf has several issues in regards to preventing rollback attacks: 1. It does not take into account the content of any previously trusted metadata, if available, before proceeding with updating roles other than the root role (i.e., steps 5.4.3.1 and 5.5.5 of the detailed client workflow). This means that any form of version verification done on the newly-downloaded metadata is made using the default value of zero, which always passes. 1. For both timestamp and snapshot roles, go-tuf saves these metadata files as trusted before verifying if the version of the metafiles they refer to is correct (i.e., steps 5.5.4 and 5.6.4 of the detailed client workflow).
Patches
A fix is available in version 0.3.0 or newer.
Workarounds
No workarounds are known for this issue apart from upgrading.
References
- Commit resolving the issue https://github.com/theupdateframework/go-tuf/commit/ed6788e710fc3093a7ecc2d078bf734c0f200d8d
- TUF specification version against which this vulnerability is observed is v.1.0.28. For more details, refer to Section 5.
- Codebase that is affected is go-tuf@f0c3294f63b9145029464164f9bce49553b77cbb
For more information
If you have any questions or comments about this advisory: * Open an issue in go-tuf * Email us at TUF's mailing list * The #tuf channel on CNCF Slack.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/theupdateframework/go-tuf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-29173"
],
"database_specific": {
"cwe_ids": [
"CWE-354"
],
"github_reviewed": true,
"github_reviewed_at": "2022-05-24T20:50:46Z",
"nvd_published_at": "2022-05-05T23:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\n[go-tuf](https://github.com/theupdateframework/go-tuf) does not correctly implement the [client workflow](https://theupdateframework.github.io/specification/v1.0.28/index.html#detailed-client-workflow) for updating the metadata files for roles other than the root role. Specifically, checks for rollback attacks are not implemented correctly meaning an attacker can cause clients to install software that is older than the software which the client previously knew to be available, and may include software with known vulnerabilities.\n\nIn more detail, the client code of go-tuf has several issues in regards to preventing rollback attacks:\n1. It does not take into account the content of any previously trusted metadata, if available, before proceeding with updating roles other than the root role (i.e., steps 5.4.3.1 and 5.5.5 of the detailed client workflow). This means that any form of version verification done on the newly-downloaded metadata is made using the default value of zero, which always passes. \n1. For both timestamp and snapshot roles, go-tuf saves these metadata files as trusted before verifying if the version of the metafiles they refer to is correct (i.e., steps 5.5.4 and 5.6.4 of the detailed client workflow).\n\n### Patches\n\nA fix is available in version 0.3.0 or newer.\n\n### Workarounds\n\nNo workarounds are known for this issue apart from upgrading.\n\n### References\n\n* Commit resolving the issue https://github.com/theupdateframework/go-tuf/commit/ed6788e710fc3093a7ecc2d078bf734c0f200d8d\n* TUF specification version against which this vulnerability is observed is [v.1.0.28](https://theupdateframework.github.io/specification/v1.0.28/index.html#detailed-client-workflow). For more details, refer to Section 5.\n* Codebase that is affected is [go-tuf@f0c3294f63b9145029464164f9bce49553b77cbb](https://github.com/theupdateframework/go-tuf/tree/f0c3294f63b9145029464164f9bce49553b77cbb)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [go-tuf](https://github.com/theupdateframework/go-tuf/issues)\n* Email us at TUF\u0027s [mailing list](mailto:theupdateframework@googlegroups.com)\n* The [#tuf](https://cloud-native.slack.com/archives/C8NMD3QJ3) channel on [CNCF Slack](https://slack.cncf.io/).",
"id": "GHSA-66x3-6cw3-v5gj",
"modified": "2022-05-24T20:50:46Z",
"published": "2022-05-24T20:50:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-66x3-6cw3-v5gj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29173"
},
{
"type": "WEB",
"url": "https://github.com/theupdateframework/go-tuf/commit/ed6788e710fc3093a7ecc2d078bf734c0f200d8d"
},
{
"type": "PACKAGE",
"url": "https://github.com/theupdateframework/go-tuf"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-0444"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Validation of Integrity Check Value in go-tuf"
}
GHSA-67FH-HVMH-RHV8
Vulnerability from github – Published: 2023-11-21 12:30 – Updated: 2026-01-06 09:30An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. This issue affects Client Connector: before 4.2.0.149.
{
"affected": [],
"aliases": [
"CVE-2023-28802"
],
"database_specific": {
"cwe_ids": [
"CWE-354"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-21T11:15:08Z",
"severity": "MODERATE"
},
"details": "An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. This issue affects Client Connector: before 4.2.0.149.",
"id": "GHSA-67fh-hvmh-rhv8",
"modified": "2026-01-06T09:30:28Z",
"published": "2023-11-21T12:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28802"
},
{
"type": "WEB",
"url": "https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Windows\u0026applicable_version=4.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6WVF-F2VW-3425
Vulnerability from github – Published: 2024-05-14 18:30 – Updated: 2025-02-25 18:39A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/containers/image"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.30.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/containers/image/v5"
},
"ranges": [
{
"events": [
{
"introduced": "5.30.0"
},
{
"fixed": "5.30.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/containers/image/v5"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.29.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-3727"
],
"database_specific": {
"cwe_ids": [
"CWE-354"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:38:29Z",
"nvd_published_at": "2024-05-14T15:42:07Z",
"severity": "HIGH"
},
"details": "A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.",
"id": "GHSA-6wvf-f2vw-3425",
"modified": "2025-02-25T18:39:25Z",
"published": "2024-05-14T18:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3727"
},
{
"type": "WEB",
"url": "https://github.com/containers/image/commit/132678b47bae29c710589012668cb85859d88385"
},
{
"type": "WEB",
"url": "https://github.com/containers/image/commit/e8948046055060605bd68289d406ce149590c33a"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0045"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:9098"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:9102"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:9960"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-3727"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274767"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-6wvf-f2vw-3425"
},
{
"type": "PACKAGE",
"url": "https://github.com/containers/image"
},
{
"type": "WEB",
"url": "https://github.com/containers/image/releases/tag/v5.29.3"
},
{
"type": "WEB",
"url": "https://github.com/containers/image/releases/tag/v5.30.1"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4HEYS34N55G7NOQZKNEXZKQVNDGEICCD"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6B37TXOKTKDBE2V26X2NSP7JKNMZOFVP"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYT3D2P3OJKISNFKOOHGY6HCUCQZYAVR"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLND3YDQQRWVRIUPL2G5UKXP5L3VSBBT"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DTOMYERG5ND4QFDHC4ZSGCED3T3ESRSC"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FBZQ2ZRMFEUQ35235B2HWPSXGDCBZHFV"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QFXMF3VVKIZN7ZMB7PKZCSWV6MOMTGMQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SFVSMR7TNLO2KPWJSW4CF64C2QMQXCIN"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3718"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:4159"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:4613"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:4850"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:4960"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:5258"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:5951"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:6054"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:6122"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:6708"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:6818"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:6824"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:7164"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:7174"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:7182"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:7187"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:7922"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:7941"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8260"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8425"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:9097"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "github.com/containers/image allows unexpected authenticated registry accesses"
}
GHSA-757V-57MW-8GQ9
Vulnerability from github – Published: 2024-08-08 18:31 – Updated: 2024-08-19 21:35Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR10 fails to validate /etc/mtab during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system's hard disk.
{
"affected": [],
"aliases": [
"CVE-2023-24063"
],
"database_specific": {
"cwe_ids": [
"CWE-354"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-08T18:15:09Z",
"severity": "MODERATE"
},
"details": "Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR10 fails to validate /etc/mtab during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system\u0027s hard disk.",
"id": "GHSA-757v-57mw-8gq9",
"modified": "2024-08-19T21:35:07Z",
"published": "2024-08-08T18:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24063"
},
{
"type": "WEB",
"url": "https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Matt%20Burch%20-%20Where%E2%80%99s%20the%20Money%20-%20Defeating%20ATM%20Disk%20Encryption-white%20paper.pdf"
},
{
"type": "WEB",
"url": "https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/security"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7CF5-CV98-V7J6
Vulnerability from github – Published: 2025-12-22 06:30 – Updated: 2026-01-15 21:31Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthorized firmware.
{
"affected": [],
"aliases": [
"CVE-2025-11543"
],
"database_specific": {
"cwe_ids": [
"CWE-354"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-22T05:16:18Z",
"severity": "CRITICAL"
},
"details": "Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthorized firmware.",
"id": "GHSA-7cf5-cv98-v7j6",
"modified": "2026-01-15T21:31:42Z",
"published": "2025-12-22T06:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11543"
},
{
"type": "WEB",
"url": "https://sharp-displays.jp.sharp/global/support/info/PJ-CVE-2025-11540.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7FJP-X968-HG59
Vulnerability from github – Published: 2022-05-24 17:41 – Updated: 2022-05-24 17:41There is an insufficient integrity check vulnerability in Huawei Sound X Product. The system does not check certain software package's integrity sufficiently. Successful exploit could allow an attacker to load a crafted software package to the device. Affected product versions include:AIS-BW80H-00 versions 9.0.3.1(H100SP13C00),9.0.3.1(H100SP18C00),9.0.3.1(H100SP3C00),9.0.3.1(H100SP9C00),9.0.3.2(H100SP1C00),9.0.3.2(H100SP2C00),9.0.3.2(H100SP5C00),9.0.3.2(H100SP8C00),9.0.3.3(H100SP1C00).
{
"affected": [],
"aliases": [
"CVE-2020-9118"
],
"database_specific": {
"cwe_ids": [
"CWE-354"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-06T02:15:00Z",
"severity": "MODERATE"
},
"details": "There is an insufficient integrity check vulnerability in Huawei Sound X Product. The system does not check certain software package\u0027s integrity sufficiently. Successful exploit could allow an attacker to load a crafted software package to the device. Affected product versions include:AIS-BW80H-00 versions 9.0.3.1(H100SP13C00),9.0.3.1(H100SP18C00),9.0.3.1(H100SP3C00),9.0.3.1(H100SP9C00),9.0.3.2(H100SP1C00),9.0.3.2(H100SP2C00),9.0.3.2(H100SP5C00),9.0.3.2(H100SP8C00),9.0.3.3(H100SP1C00).",
"id": "GHSA-7fjp-x968-hg59",
"modified": "2022-05-24T17:41:13Z",
"published": "2022-05-24T17:41:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9118"
},
{
"type": "WEB",
"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210113-01-ais-en"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7J39-H6J3-5G47
Vulnerability from github – Published: 2025-11-14 18:31 – Updated: 2025-11-14 18:31An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to revert the browser’s security controls.
{
"affected": [],
"aliases": [
"CVE-2025-4616"
],
"database_specific": {
"cwe_ids": [
"CWE-354"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-14T18:15:47Z",
"severity": "LOW"
},
"details": "An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma\u00ae Browser allows a locally authenticated non-admin user to revert the browser\u2019s security controls.",
"id": "GHSA-7j39-h6j3-5g47",
"modified": "2025-11-14T18:31:39Z",
"published": "2025-11-14T18:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4616"
},
{
"type": "WEB",
"url": "https://security.paloaltonetworks.com/CVE-2025-4616"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
"type": "CVSS_V4"
}
]
}
GHSA-7V42-G35V-XRCH
Vulnerability from github – Published: 2026-02-17 21:29 – Updated: 2026-02-20 16:44Impact
An issue was discovered in httpsig-hyper where Digest header verification could incorrectly succeed due to misuse of Rust's matches! macro. Specifically, the comparison:
if matches!(digest, _expected_digest)
treated _expected_digest as a pattern binding rather than a value comparison, resulting in unconditional success of the match expression.
As a consequence, digest verification could incorrectly return success even when the computed digest did not match the expected value.
Applications relying on Digest verification as part of HTTP message signature validation may therefore fail to detect message body modification. The severity depends on how the library is integrated and whether additional signature validation layers are enforced.
Patches
This issue has been fixed in:
httpsig-hyper>= 0.0.23
The fix replaces the incorrect matches! usage with proper value comparison and additionally introduces constant-time comparison for digest verification as defense-in-depth.
Regression tests have also been added to prevent reintroduction of this issue. Users are strongly advised to upgrade to the patched version.
Workarounds
There is no reliable workaround without upgrading. Users who cannot immediately upgrade should avoid relying solely on Digest verification for message integrity and ensure that full HTTP message signature verification is enforced at the application layer.
References
- PR: https://github.com/junkurihara/httpsig-rs/pull/14
- Follow-up hardening and test additions: https://github.com/junkurihara/httpsig-rs/pull/15
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "httpsig-hyper"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.23"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-26275"
],
"database_specific": {
"cwe_ids": [
"CWE-354",
"CWE-697"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-17T21:29:34Z",
"nvd_published_at": "2026-02-19T22:16:46Z",
"severity": "HIGH"
},
"details": "### Impact\n\nAn issue was discovered in `httpsig-hyper` where Digest header verification could incorrectly succeed due to misuse of Rust\u0027s `matches!` macro. Specifically, the comparison:\n\n```rust\nif matches!(digest, _expected_digest)\n```\n\ntreated `_expected_digest` as a pattern binding rather than a value comparison, resulting in unconditional success of the match expression.\n\nAs a consequence, digest verification could incorrectly return success even when the computed digest did not match the expected value.\n\nApplications relying on Digest verification as part of HTTP message signature validation may therefore fail to detect message body modification. The severity depends on how the library is integrated and whether additional signature validation layers are enforced.\n\n---\n\n### Patches\n\nThis issue has been fixed in:\n\n- `httpsig-hyper` \u003e= 0.0.23\n\nThe fix replaces the incorrect `matches!` usage with proper value comparison and additionally introduces constant-time comparison for digest verification as defense-in-depth.\n\nRegression tests have also been added to prevent reintroduction of this issue. Users are strongly advised to upgrade to the patched version.\n\n---\n\n### Workarounds\n\nThere is no reliable workaround without upgrading. Users who cannot immediately upgrade should avoid relying solely on Digest verification for message integrity and ensure that full HTTP message signature verification is enforced at the application layer.\n\n---\n\n### References\n\n- PR: https://github.com/junkurihara/httpsig-rs/pull/14\n- Follow-up hardening and test additions: https://github.com/junkurihara/httpsig-rs/pull/15",
"id": "GHSA-7v42-g35v-xrch",
"modified": "2026-02-20T16:44:04Z",
"published": "2026-02-17T21:29:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/junkurihara/httpsig-rs/security/advisories/GHSA-7v42-g35v-xrch"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26275"
},
{
"type": "WEB",
"url": "https://github.com/junkurihara/httpsig-rs/pull/14"
},
{
"type": "WEB",
"url": "https://github.com/junkurihara/httpsig-rs/pull/15"
},
{
"type": "WEB",
"url": "https://github.com/junkurihara/httpsig-rs/commit/5533f596c650377e02f4aa9e3eb8dba591b87370"
},
{
"type": "WEB",
"url": "https://github.com/junkurihara/httpsig-rs/commit/65cbd19b395180a4bba09a89746c4b14ccb8d297"
},
{
"type": "PACKAGE",
"url": "https://github.com/junkurihara/httpsig-rs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Digest Verification in httpsig-hyper May Allow Message Integrity Bypass"
}
GHSA-833G-4XXM-R9CX
Vulnerability from github – Published: 2026-08-03 06:31 – Updated: 2026-09-02 15:34In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
{
"affected": [],
"aliases": [
"CVE-2026-12802"
],
"database_specific": {
"cwe_ids": [
"CWE-354"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-03T04:16:38Z",
"severity": "HIGH"
},
"details": "In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).",
"id": "GHSA-833g-4xxm-r9cx",
"modified": "2026-09-02T15:34:24Z",
"published": "2026-08-03T06:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12802"
},
{
"type": "WEB",
"url": "https://github.com/bcgit/bc-java/commit/0fefa539e6ac5c66e1daee5a13b23d1d4769cc01"
},
{
"type": "WEB",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012802"
},
{
"type": "WEB",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-12802"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber",
"type": "CVSS_V4"
}
]
}
Mitigation
Ensure that the checksums present in messages are properly checked in accordance with the protocol specification before they are parsed and used.
CAPEC-145: Checksum Spoofing
An adversary spoofs a checksum message for the purpose of making a payload appear to have a valid corresponding checksum. Checksums are used to verify message integrity. They consist of some value based on the value of the message they are protecting. Hash codes are a common checksum mechanism. Both the sender and recipient are able to compute the checksum based on the contents of the message. If the message contents change between the sender and recipient, the sender and recipient will compute different checksum values. Since the sender's checksum value is transmitted with the message, the recipient would know that a modification occurred. In checksum spoofing an adversary modifies the message body and then modifies the corresponding checksum so that the recipient's checksum calculation will match the checksum (created by the adversary) in the message. This would prevent the recipient from realizing that a change occurred.
CAPEC-463: Padding Oracle Crypto Attack
An adversary is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an adversary is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In addition to performing decryption, an adversary is also able to produce valid ciphertexts (i.e., perform encryption) by using the padding oracle, all without knowing the encryption key.
CAPEC-75: Manipulating Writeable Configuration Files
Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.