CVE-2026-129118: C-Kermit 8.0.200 before 11.1.515 Improper Certificate Hostname Matching via dNSName_cmp

Q: Which connections are exposed to this issue?

C-Kermit TLS connections made using Telnet, FTP, or HTTP are affected when running a version from 8.0.200 before 11.1.515.

Q: What does an attacker need to exploit the flaw?

The attacker needs a trusted certificate whose name contains over-matching wildcard-like patterns, including asterisks, question marks, brackets, or empty labels. They can use this to impersonate a host and intercept credentials or data.

Q: What version resolves the issue?

Upgrade C-Kermit to version 11.1.515 or later. The affected range is 8.0.200 through versions before 11.1.515.

Published Nov 13, 2026

Updated

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by abusing wildcard matching in dNSNamecmp() in ckssl.c. Attackers holding a trusted certificate with over-matching names containing asterisks, question marks, brackets, or empty labels can intercept credentials and data over Telnet, FTP, and HTTP TLS connections.

Affected Software

1 affected component

Kermit Project C-Kermit>=8.0.200<11.1.515

Event History

Nov 13, 2026

CVE Published

via MITRE·04:23 PM

Data Sourced

via MITRE·04:23 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which connections are exposed to this issue?

C-Kermit TLS connections made using Telnet, FTP, or HTTP are affected when running a version from 8.0.200 before 11.1.515.

What does an attacker need to exploit the flaw?

The attacker needs a trusted certificate whose name contains over-matching wildcard-like patterns, including asterisks, question marks, brackets, or empty labels. They can use this to impersonate a host and intercept credentials or data.

What version resolves the issue?