CVE-2026-57826: OpenHiTLS openHiTLS vulnerability

Q: Which certificate-validation scenarios are affected?

Deployments using openHiTLS versions 0.2.0 through 0.3.2 for X.509 certificate chain verification are affected when a chain includes an intermediate CA certificate encoded as version 1 or version 2. The issue concerns validation of basic constraints and the CA flag on those intermediate certificates.

Q: What does an attacker need to exploit this issue?

An attacker would need to present or cause validation of a certificate chain containing a v1 or v2 intermediate certificate. For those certificate versions, the affected releases ignore basic constraints and CA-flag processing during chain verification.

Q: What version addresses the issue?

Upgrade to openHiTLS 0.3.3, as indicated by the referenced comparison from 0.3.2 to 0.3.3. If an immediate upgrade is not possible, the provided data does not specify a workaround.

Published Aug 18, 2026

Updated

An issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermediate CAs are only verified for v3 certificates, and v1/v2 certificates are ignored.

Affected Software

1 affected component

openHiTLS openHiTLS>=0.2.0<=0.3.2

Event History

Aug 18, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which certificate-validation scenarios are affected?

Deployments using openHiTLS versions 0.2.0 through 0.3.2 for X.509 certificate chain verification are affected when a chain includes an intermediate CA certificate encoded as version 1 or version 2. The issue concerns validation of basic constraints and the CA flag on those intermediate certificates.

What does an attacker need to exploit this issue?

An attacker would need to present or cause validation of a certificate chain containing a v1 or v2 intermediate certificate. For those certificate versions, the affected releases ignore basic constraints and CA-flag processing during chain verification.

What version addresses the issue?

Upgrade to openHiTLS 0.3.3, as indicated by the referenced comparison from 0.3.2 to 0.3.3. If an immediate upgrade is not possible, the provided data does not specify a workaround.