CVE-2026-8367: aria2c Improper Certificate Validation
aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure aria2c validates the Extended Key Usage (EKU) field of TLS server certificates and only accepts certificates that include the TLS Web Server Authentication (serverAuth) purpose. If a configuration option is not available, apply vendor patches or rebuild with EKU checking enabled when a fix is provided.
aria2c Extended Key Usage (EKU) validation = enforce serverAuth EKU - Compensating control
Until EKU validation is enforced in aria2c, restrict aria2c's network access to only trusted servers (via firewall rules, ACLs, or network segmentation) and use certificate pinning or manual verification of server certificate fingerprints to mitigate the risk of a reused/compromised certificate being accepted.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8367?
CVE-2026-8367 has been classified as a high severity vulnerability due to improper certificate validation.
How do I fix CVE-2026-8367?
To fix CVE-2026-8367, ensure you are using the latest version of aria2c that addresses this improper certificate validation issue.
What causes CVE-2026-8367?
CVE-2026-8367 is caused by aria2c accepting server certificates with incorrect Extended Key Usage (EKU), leading to potential misuse.
Who is affected by CVE-2026-8367?
Users of aria2 and aria2c versions prior to the fix are affected by CVE-2026-8367.
What are the potential risks of CVE-2026-8367?
The risks of CVE-2026-8367 include the possibility of attackers exploiting compromised certificates for TLS server authentication.