CVE-2026-109144: wbond certvalidator Certificate Path Builder resource consumption
A vulnerability was identified in wbond certvalidator up to 0.11.1. This issue affects some unknown processing of the component Certificate Path Builder. Such manipulation leads to resource consumption. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the PyPI certvalidator package at version 0.11.1 or earlier are affected. The issue is in Certificate Path Builder processing.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates that the attack is network-reachable, requires low attack complexity, and needs neither privileges nor user interaction.
What is the expected impact of successful exploitation?
The reported impact is resource consumption, with availability affected at a low level. No confidentiality or integrity impact is indicated.
Is a vendor fix or workaround available?
The available data does not identify a fixed version or workaround. It states that the vendor was contacted early but did not respond.