{"id":"CVE-2026-11751","details":"A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections.","aliases":["GHSA-6qfw-3mvj-m6v5"],"modified":"2026-10-21T02:55:55.233983023Z","published":"2026-08-19T01:19:34.960Z","database_specific":{"cna_assigner":"LY-Corporation","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11751.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11751.json"},{"type":"ADVISORY","url":"https://github.com/line/armeria/security/advisories/GHSA-6qfw-3mvj-m6v5"},{"type":"ADVISORY","url":"https://line.github.io/security-advisory-blog/CVE-2026-11751/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11751"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/line/armeria","events":[{"introduced":"0"},{"fixed":"ed3f569ac354375221cf0d8d3790599aea96a877"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"InverseAffectedRanges","range":[{"introduced":"0"},{"fixed":"1.41.0"}]},{"range":[{"introduced":"0"},{"fixed":"1.41.0"}],"source":"DESCRIPTION"}]}}],"versions":["armeria-0.27.0.Final","armeria-0.26.1.Final","armeria-0.26.0.Final","armeria-0.25.0.Final","armeria-0.24.1.Final","armeria-0.24.0.Final","armeria-0.23.1.Final","armeria-0.23.0.Final","armeria-0.22.0.Final","armeria-0.21.6.Final","armeria-0.21.5.Final","armeria-0.21.4.Final","armeria-0.21.3.Final","armeria-0.21.2.Final","armeria-0.21.1.Final","armeria-0.21.0.Final","armeria-0.20.2.Final","armeria-0.20.1.Final","armeria-0.20.0.Final","armeria-0.19.0.Final","armeria-0.18.0.Final","armeria-0.17.0.Final","armeria-0.16.1.Final","armeria-0.16.0.Final","armeria-0.15.0.Final","armeria-0.14.0.Final","armeria-0.13.4.Final","armeria-0.13.3.Final","armeria-0.13.2.Final","armeria-0.13.1.Final","armeria-0.13.0.Final","armeria-0.12.2.Final","armeria-0.12.1.Final","armeria-0.12.0.Final","armeria-0.11.0.Final","armeria-0.10.0.Final","armeria-0.9.0.Final","armeria-0.8.0.Final","armeria-0.7.0.Final","armeria-0.6.4.Final","armeria-0.6.3.Final","armeria-0.6.2.Final","armeria-0.6.1.Final","armeria-0.6.0.Final","armeria-0.5.1.Final","armeria-0.5.0.Final","armeria-0.4.0.Final"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11751.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}