AZL-112490: CVE-2026-118780 affecting package python-tensorboard 2.16.2-6

Q: What conditions are required to trigger the availability impact?

An application must use the affected node-forge certificate-chain verification behavior with certificates that share a subject name. A failed verification attempt can then remove trusted CA certificates from the CA store used by the application.

Q: Which deployments are most exposed to persistent failures?

Applications that reuse the same CA store across certificate-chain verification attempts are exposed to persistent availability impact. Once a failed verification removes a trusted CA certificate, later valid chains may fail when using that reused store.

Q: What can be done if updating is not immediately possible?

Avoid reusing a CA store after failed certificate-chain verification attempts, since the described impact depends on the modified store being reused. Recreating the CA store for subsequent verification attempts can prevent prior failures from persisting in that store.

Q: How can I tell whether this issue may already be affecting an application?

Look for valid certificate chains failing after an earlier failed verification involving certificates with duplicate subject names. The issue is consistent with trusted CA certificates having been removed from a reused CA store.

Published Oct 29, 2026

Updated

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or security decision. node-forge modified the CA store while trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail and creating a persistent availability impact for applications that reused the store. This issue is fixed in version 1.4.1.

Affected Software

1 affected component

azure-linux/python-tensorboard<=2.16.2-6

Event History

Oct 29, 2026

Advisory Published

via OSV·07:17 PM

Data Sourced

via OSV·07:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-118780

Frequently Asked Questions

What conditions are required to trigger the availability impact?

An application must use the affected node-forge certificate-chain verification behavior with certificates that share a subject name. A failed verification attempt can then remove trusted CA certificates from the CA store used by the application.

Which deployments are most exposed to persistent failures?

Applications that reuse the same CA store across certificate-chain verification attempts are exposed to persistent availability impact. Once a failed verification removes a trusted CA certificate, later valid chains may fail when using that reused store.

What can be done if updating is not immediately possible?

Avoid reusing a CA store after failed certificate-chain verification attempts, since the described impact depends on the modified store being reused. Recreating the CA store for subsequent verification attempts can prevent prior failures from persisting in that store.

How can I tell whether this issue may already be affecting an application?

Look for valid certificate chains failing after an earlier failed verification involving certificates with duplicate subject names. The issue is consistent with trusted CA certificates having been removed from a reused CA store.

AZL-112490: CVE-2026-118780 affecting package python-tensorboard 2.16.2-6

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required to trigger the availability impact?

Which deployments are most exposed to persistent failures?

What can be done if updating is not immediately possible?

How can I tell whether this issue may already be affecting an application?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the availability impact?

Which deployments are most exposed to persistent failures?

What can be done if updating is not immediately possible?

How can I tell whether this issue may already be affecting an application?