Repository navigation
Security: digitalbazaar/forge
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
TLS client crash on an unsupported ServerHello compression methodGHSA-w4xr-hqv8-ch44 published
Nov 4, 2026 by davidlehnModerate -
ReDoS in forge.http response header and cookie trimmingGHSA-6cv4-p8m7-4r25 published
Nov 4, 2026 by davidlehnModerate -
TLS client crash on a handshake record received without a sessionGHSA-j8rw-jp99-435v published
Nov 4, 2026 by davidlehnModerate -
Ed25519 signature verification accepts small-order public keysGHSA-6889-vf6x-f3g5 published
Nov 4, 2026 by davidlehnLow -
ASN.1 OID first arc truncation in asn1.oidToDerGHSA-4642-5mcj-2rqw published
Oct 27, 2026 by davidlehnLow -
Certificate signature verified with the issuer's RSA signature schemeGHSA-9wg5-mj3p-v49q published
Oct 27, 2026 by davidlehnLow -
Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)GHSA-h6cr-wjv9-3cpp published
Oct 27, 2026 by davidlehnLow -
verifyCertificateChain() removes trusted CA certificates with the same subject from the CA storeGHSA-4487-j8r4-4g2f published
Oct 27, 2026 by davidlehnLow -
AES-GCM authentication bypass via unvalidated tagLength optionGHSA-5cwg-6vw7-rj6p published
Oct 27, 2026 by davidlehnModerate -
PKCS#12 MAC forgery and constant-key PBE via zero iteration countGHSA-jc66-7q78-782g published
Oct 27, 2026 by davidlehnHigh