CVE-2026-8367 — aria2c Improper Certificate Validation

CVE-2026-8367

aria2c Improper Certificate Validation PUBLISHED

Description (CNA)

aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.

Affected (CNA)

Vendor / product	Versions
aria2_project / aria2c	affected 0 through 1.37.0

CWE

CWE-295

References

https://www.tenable.com/security/research/tra-2026-38

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.