CVE-2026-8367 aria2c Improper Certificate Validation
MediumCVSS 5.3
EPSS 0.13%
- Published
- Updated
- Exploit status
- No public exploit known
Description
aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| aria2_project aria2c | <= 1.37.0 | No fix listed |
| debian/aria2(Debian:12) | All versions | No fix listed |
| debian/aria2(Debian:12) | = 1.36.0-1 | No fix listed |
| debian/aria2(Debian:12) | = 1.36.0-2 | No fix listed |
| debian/aria2(Debian:13) | All versions | No fix listed |
| debian/aria2(Debian:13) | = 0.10.1-1 | No fix listed |
| debian/aria2(Debian:13) | = 0.10.2+1-1 | No fix listed |
| debian/aria2(Debian:13) | = 0.11.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 0.11.2-1 | No fix listed |
| debian/aria2(Debian:13) | = 0.11.3-1 | No fix listed |
| debian/aria2(Debian:13) | = 0.12.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 0.12.1-1 | No fix listed |
| debian/aria2(Debian:13) | = 0.13.1+1-1 | No fix listed |
| debian/aria2(Debian:13) | = 0.14.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 0.14.0-1+lenny1 | No fix listed |
| debian/aria2(Debian:13) | = 0.14.0-1+lenny2 | No fix listed |
| debian/aria2(Debian:13) | = 0.7.3-1 | No fix listed |
| debian/aria2(Debian:13) | = 0.8.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 0.8.1-1 | No fix listed |
| debian/aria2(Debian:13) | = 0.9.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.0.1-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.1.2-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.10.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.10.0-2 | No fix listed |
| debian/aria2(Debian:13) | = 1.10.6-1 | No fix listed |
Show 156 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/aria2(Debian:13) | = 1.10.9-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.11.1-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.11.2-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.12.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.12.1-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.12.1-2 | No fix listed |
| debian/aria2(Debian:13) | = 1.13.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.14.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.14.1-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.14.2-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.14.2-2 | No fix listed |
| debian/aria2(Debian:13) | = 1.15.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.15.0-2 | No fix listed |
| debian/aria2(Debian:13) | = 1.15.1-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.15.2-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.16.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.16.1-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.17.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.18.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.18.0-2 | No fix listed |
| debian/aria2(Debian:13) | = 1.18.1-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.18.10-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.18.10-2 | No fix listed |
| debian/aria2(Debian:13) | = 1.18.3-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.18.5-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.18.7-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.18.8-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.19.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.2.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.21.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.24.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.25.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.26.1-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.27.1-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.29.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.3.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.3.2-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.30.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.30.0-2 | No fix listed |
| debian/aria2(Debian:13) | = 1.31.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.32.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.32.0-2 | No fix listed |
| debian/aria2(Debian:13) | = 1.33.1-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.34.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.34.0-2 | No fix listed |
| debian/aria2(Debian:13) | = 1.34.0-3 | No fix listed |
| debian/aria2(Debian:13) | = 1.34.0-4 | No fix listed |
| debian/aria2(Debian:13) | = 1.35.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.35.0-2 | No fix listed |
| debian/aria2(Debian:13) | = 1.35.0-3 | No fix listed |
| debian/aria2(Debian:13) | = 1.36.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.36.0-2 | No fix listed |
| debian/aria2(Debian:13) | = 1.4.1-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.6.2-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.6.2-2 | No fix listed |
| debian/aria2(Debian:13) | = 1.6.2-3 | No fix listed |
| debian/aria2(Debian:13) | = 1.7.1-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.7.2-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.8.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.8.2-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.9.0-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.9.1-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.9.3-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.9.4-1 | No fix listed |
| debian/aria2(Debian:13) | = 1.9.5-1 | No fix listed |
| debian/aria2(Debian:14) | All versions | No fix listed |
| debian/aria2(Debian:14) | = 0.10.1-1 | No fix listed |
| debian/aria2(Debian:14) | = 0.10.2+1-1 | No fix listed |
| debian/aria2(Debian:14) | = 0.11.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 0.11.2-1 | No fix listed |
| debian/aria2(Debian:14) | = 0.11.3-1 | No fix listed |
| debian/aria2(Debian:14) | = 0.12.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 0.12.1-1 | No fix listed |
| debian/aria2(Debian:14) | = 0.13.1+1-1 | No fix listed |
| debian/aria2(Debian:14) | = 0.14.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 0.14.0-1+lenny1 | No fix listed |
| debian/aria2(Debian:14) | = 0.14.0-1+lenny2 | No fix listed |
| debian/aria2(Debian:14) | = 0.7.3-1 | No fix listed |
| debian/aria2(Debian:14) | = 0.8.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 0.8.1-1 | No fix listed |
| debian/aria2(Debian:14) | = 0.9.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.0.1-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.1.2-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.10.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.10.0-2 | No fix listed |
| debian/aria2(Debian:14) | = 1.10.6-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.10.9-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.11.1-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.11.2-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.12.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.12.1-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.12.1-2 | No fix listed |
| debian/aria2(Debian:14) | = 1.13.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.14.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.14.1-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.14.2-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.14.2-2 | No fix listed |
| debian/aria2(Debian:14) | = 1.15.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.15.0-2 | No fix listed |
| debian/aria2(Debian:14) | = 1.15.1-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.15.2-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.16.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.16.1-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.17.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.18.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.18.0-2 | No fix listed |
| debian/aria2(Debian:14) | = 1.18.1-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.18.10-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.18.10-2 | No fix listed |
| debian/aria2(Debian:14) | = 1.18.3-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.18.5-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.18.7-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.18.8-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.19.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.2.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.21.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.24.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.25.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.26.1-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.27.1-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.29.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.3.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.3.2-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.30.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.30.0-2 | No fix listed |
| debian/aria2(Debian:14) | = 1.31.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.32.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.32.0-2 | No fix listed |
| debian/aria2(Debian:14) | = 1.33.1-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.34.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.34.0-2 | No fix listed |
| debian/aria2(Debian:14) | = 1.34.0-3 | No fix listed |
| debian/aria2(Debian:14) | = 1.34.0-4 | No fix listed |
| debian/aria2(Debian:14) | = 1.35.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.35.0-2 | No fix listed |
| debian/aria2(Debian:14) | = 1.35.0-3 | No fix listed |
| debian/aria2(Debian:14) | = 1.36.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.36.0-2 | No fix listed |
| debian/aria2(Debian:14) | = 1.4.1-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.6.2-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.6.2-2 | No fix listed |
| debian/aria2(Debian:14) | = 1.6.2-3 | No fix listed |
| debian/aria2(Debian:14) | = 1.7.1-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.7.2-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.8.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.8.2-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.9.0-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.9.1-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.9.3-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.9.4-1 | No fix listed |
| debian/aria2(Debian:14) | = 1.9.5-1 | No fix listed |
| ubuntu/aria2(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/aria2(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/aria2(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/aria2(Ubuntu:26.10) | All versions | No fix listed |
| aria2_project aria2 | < 1.37.0 | 1.37.0 |
References
- www.tenable.com exploit third-party-advisory
- Debian Security Tracker CVE-2026-8367 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- bugs.debian.org issue-tracking