CVE-2026-57826
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In openHiTLS 0.2.0 through 0.3.2, during X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermediate CAs are only verified for v3 certificates, and v1/v2 certificates are ignored.
Risk Assessment
This could allow acceptance of invalid certificate chains, weakening trust in authentication and communication integrity.
Recommendation
Update openHiTLS to a version that properly handles v1/v2 certificates and review certificate verification settings.
Original NVD description (English source)
An issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermediate CAs are only verified for v3 certificates, and v1/v2 certificates are ignored.