CWE-297 · Cryptography
Improper Validation of Certificate with Host Mismatch
101CVEs
SortMost likely exploited
101 CVEs with CWE-297 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2014-3522The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field…Apache · Subversion · 2014-08-19 | – | 5.6% | 2014-08-19 |
| CVE-2018-10936A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to th…Postgresql · PostgreSQL · CVSS 8.1 · 2018-08-30 | 8.1 | 2.9% | 2018-08-30 |
| CVE-2021-44549SMTPS server hostname not checked when making TLS connection to SMTPS serverApache Software Foundation · Apache Sling Commons Messaging Mail · 2021-12-14 | – | 2.1% | 2021-12-14 |
| CVE-2020-1887Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of a configured root c…Facebook · Osquery · 2020-03-12 | – | 1.6% | 2020-03-12 |
| CVE-2024-2466TLS certificate check bypass with mbedTLScurl · curl · CVSS 6.5 · 2024-03-27 | 6.5 | 1.5% | 2024-03-27 |
| CVE-2020-14387A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit th…Samba · rsync · 2021-05-27 | – | 1.1% | 2021-05-27 |
| CVE-2020-15260Existing TLS connections can be reused without checking remote hostnamepjsip · pjproject · CVSS 6.8 · 2021-03-10 | 6.8 | 1.0% | 2021-03-10 |
| CVE-2022-32153Splunk Enterprise lacked TLS host name validationSplunk, Inc · Splunk Enterprise · CVSS 8.1 · 2022-06-15 | 8.1 | 0.9% | 2022-06-15 |
| CVE-2020-1758A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an att…Red Hat · keycloak · CVSS 5.3 · 2020-05-15 | 5.3 | 0.9% | 2020-05-15 |
| CVE-2014-3603The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostna…Shibboleth; OpenSAML Java · Identity Provider (IdP) · 2019-04-04 | – | 0.8% | 2019-04-04 |
| CVE-2020-11050Improper Validation of Certificate with Host Mismatch in Java-WebSocketTooTallNate · Java-WebSocket · CVSS 9 · 2020-05-07 | 9.0 | 0.8% | 2020-05-07 |
| CVE-2024-34447An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19.…No vendor recorded · CVSS 7.5 · 2024-05-03 | 7.5 | 0.8% | 2024-05-03 |
| CVE-2025-68161Apache Log4j Core: Missing TLS hostname verification in Socket appenderApache Software Foundation · Apache Log4j Core · CVSS 6.3 · 2025-12-18 | 6.3 | 0.8% | 2025-12-18 |
| CVE-2026-86410redirect to SFTP or SCP bypasses host verificationcurl · curl · CVSS 8.1 · 2026-10-20 | 8.1 | 0.8% | 2026-10-20 |
| CVE-2021-21385Disabled hostname verification and accepting self-signed certificatesopenMF · mifos-mobile · CVSS 8.8 · 2021-03-24 | 8.8 | 0.7% | 2021-03-24 |
| CVE-2017-2911An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the rcli…Circle Media · Circle · CVSS 9 · 2017-11-07 | 9.0 | 0.7% | 2017-11-07 |
| CVE-2016-1280PKId in Juniper Junos OS before 12.1X44-D52, 12.1X46 before 12.1X46-D37, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R12, 12.3X48 before 12.3X48-D20, 13.3 before 13.3R10, 14.1 bef…Juniper · Junos · 2016-09-09 | – | 0.7% | 2016-09-09 |
| CVE-2017-2912An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the gocl…Circle Media · Circle · CVSS 7.4 · 2017-11-07 | 7.4 | 0.7% | 2017-11-07 |
| CVE-2025-46408An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpClient in AVTECH EagleEyes 2.0.0. The me…Avtech · Eagleeyes(lite) · CVSS 9.8 · 2025-09-15 | 9.8 | 0.7% | 2025-09-15 |
| CVE-2026-43869Apache Thrift: TSSLTransportFactory.java hostname verificationApache Software Foundation · Apache Thrift · CVSS 7.3 · 2026-05-05 | 7.3 | 0.6% | 2026-05-05 |
| CVE-2026-65942Apache Ranger: Clients accept TLS certificates issued for other hostnamesApache Software Foundation · Apache Ranger · CVSS 7.5 · 2026-08-10 | 7.5 | 0.6% | 2026-08-10 |
| CVE-2026-34477Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypassApache Software Foundation · Apache Log4j Core · CVSS 6.3 · 2026-04-10 | 6.3 | 0.6% | 2026-04-10 |
| CVE-2021-33695Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation of the certificate.SAP SE · SAP Cloud Connector · CVSS 6.8 · 2021-09-15 | 6.8 | 0.6% | 2021-09-15 |
| CVE-2025-15079libssh global known_hosts overridecurl · curl · CVSS 5.3 · 2026-01-08 | 5.3 | 0.5% | 2026-01-08 |
| CVE-2026-19553SSLContext.wrap_bio() missing validation of server_hostname parameterPython Software Foundation · CPython · CVSS 7.6 · 2026-09-30 | 7.6 | 0.5% | 2026-09-30 |
| CVE-2025-59060Apache Ranger: Hostname verification bypass in NiFiRegistryClientApache Software Foundation · Apache Ranger · CVSS 5.3 · 2026-03-03 | 5.3 | 0.5% | 2026-03-03 |
| CVE-2022-22305An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and 6.0.…Fortinet · FortiAnalyzer · CVSS 5.4 · 2023-09-01 | 5.4 | 0.5% | 2023-09-01 |
| CVE-2026-54275AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connectionsaio-libs · aiohttp · CVSS 2.7 · 2026-06-22 | 2.7 | 0.5% | 2026-06-22 |
| CVE-2025-3501Org.keycloak.protocol.services: keycloak hostname verificationRed Hat · Red Hat Build of Keycloak · CVSS 8.2 · 2025-04-29 | 8.2 | 0.5% | 2025-04-29 |
| CVE-2022-4967strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certificate with host mismatch (CWE-297). When certificates are used to…strongSwan · strongSwan · CVSS 7.7 · 2024-05-13 | 7.7 | 0.5% | 2024-05-13 |
| CVE-2023-5909Improper Validation of Certificate with Host Mismatch in PTC KEPServerExPTC · KEPServerEX · CVSS 7.5 · 2023-11-30 | 7.5 | 0.4% | 2023-11-30 |
| CVE-2026-48145Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard BypassApache Software Foundation · Apache Thrift · CVSS 8.2 · 2026-07-27 | 8.2 | 0.4% | 2026-07-27 |
| CVE-2026-12064proto-default skips SSH verificationcurl · curl · CVSS 7.5 · 2026-07-03 | 7.5 | 0.4% | 2026-07-03 |
| CVE-2026-48144Apache Thrift: c_glib TLS Client Missing Hostname VerificationApache Software Foundation · Apache Thrift · CVSS 9.1 · 2026-07-27 | 9.1 | 0.4% | 2026-07-27 |
| CVE-2026-92943Improper validation of certificate with host mismatch in AWS IoT Device SDK for PythonAWS · AWSIoTPythonSDK · CVSS 8.1 · 2026-09-17 | 8.1 | 0.4% | 2026-09-17 |
| CVE-2024-8285Kroxylicious: missing upstream kafka tls hostname verificationRed Hat · Streams for Apache Kafka 2.8.0 · CVSS 5.9 · 2024-08-30 | 5.9 | 0.4% | 2024-08-30 |
| CVE-2024-49782IBM OpenPages improper certificate validationIBM · OpenPages with Watson · CVSS 6.8 · 2025-02-20 | 6.8 | 0.4% | 2025-02-20 |
| CVE-2024-37015An issue was discovered in Ada Web Server 20.0. When configured to use SSL (which is not the default setting), the SSL/TLS used to establish connections to external services is do…No vendor recorded · CVSS 7.4 · 2024-08-13 | 7.4 | 0.4% | 2024-08-13 |
| CVE-2026-9547SSH improper host validationcurl · curl · CVSS 7.4 · 2026-07-03 | 7.4 | 0.4% | 2026-07-03 |
| CVE-2026-42790nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verificationErlang · OTP · CVSS 7.4 · 2026-05-27 | 7.4 | 0.4% | 2026-05-27 |
| CVE-2026-107819MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failureMariaDB · server · CVSS 5.9 · 2026-10-09 | 5.9 | 0.3% | 2026-10-09 |
| CVE-2026-59638JSSE hostname verifier CN-fallback enabled by default despite documented opt-inLegion of the Bouncy Castle Inc. · BC-JAVA · CVSS 9.3 · 2026-08-03 | 9.3 | 0.3% | 2026-08-03 |
| CVE-2026-84197In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditt…Eclipse Foundation · Eclipse Ditto · CVSS 9.2 · 2026-09-08 | 9.2 | 0.3% | 2026-09-08 |
| CVE-2024-38324IBM Storage Defender improper certificate validationIBM · Storage Defender - Resiliency Service · CVSS 5.9 · 2024-09-24 | 5.9 | 0.3% | 2024-09-24 |
| CVE-2025-2190The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks.TECNO · com.transsnet.store · CVSS 8.1 · 2025-03-11 | 8.1 | 0.3% | 2025-03-11 |
| CVE-2026-59969Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS modeApache Software Foundation · Apache ZooKeeper · CVSS 7.5 · 2026-09-16 | 7.5 | 0.3% | 2026-09-16 |
| CVE-2026-58040An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulne…nodejs · node · CVSS 6.3 · 2026-07-30 | 6.3 | 0.3% | 2026-07-30 |
| CVE-2018-19946The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerability could allow an attacker to spoof a tr…QNAP Systems Inc. · Helpdesk · CVSS 4.2 · 2020-09-11 | 4.2 | 0.3% | 2020-09-11 |
| CVE-2022-29082Dell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0.x, 19.4.x, 19.4.0.x, 19.5.x,19.5.0.x, 19.6 and 19.6.0.1 and 19.6.0.2 contain an I…Dell · NetWorker · CVSS 3.7 · 2022-05-26 | 3.7 | 0.3% | 2022-05-26 |
| CVE-2026-66053Apache Thrift: Python TSSLSocket Hostname Matcher ImportApache Software Foundation · Apache Thrift · CVSS 5.9 · 2026-07-27 | 5.9 | 0.3% | 2026-07-27 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.