{"id":"CVE-2026-57826","details":"An issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermediate CAs are only verified for v3 certificates, and v1/v2 certificates are ignored.","modified":"2026-08-21T08:06:15.643667Z","published":"2026-08-18T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57826.json"},"references":[{"type":"WEB","url":"https://gitcode.com/openHiTLS/openhitls/pull/1399"},{"type":"WEB","url":"https://gitcode.com/openHiTLS/openhitls/pull/1657"},{"type":"WEB","url":"https://github.com/openHiTLS/openHiTLS/compare/openhitls-0.3.2...openhitls-0.3.3"},{"type":"WEB","url":"https://www.openhitls.net/zh/support/HTLS-2026-001.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57826.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57826"},{"type":"FIX","url":"https://github.com/openHiTLS/openHiTLS/commit/2d3b221d113b452bc197012b185978b8314ee8a4"},{"type":"FIX","url":"https://github.com/openHiTLS/openHiTLS/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openhitls/openhitls","events":[{"introduced":"da225c3fb5f18433b9fef900ecc8d0173423640c"},{"fixed":"3d29581401bff58e07bdbe551729ef24082134c5"},{"fixed":"2d3b221d113b452bc197012b185978b8314ee8a4"},{"fixed":"4355cdf5b043d5b9ef698f8f57860f77f8e92561"}],"database_specific":{"extracted_events":[{"introduced":"0.2.0"},{"fixed":"0.3.2"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["openhitls-0.2.2-alpha1","openhitls-0.2.1","openhitls-0.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57826.json","vanir_signatures_modified":"2026-08-21T08:06:15Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["275746497929267116822623929922228215202","124183931371220500844350373075088263275","298435252645922132069982609850192493177","332904512092456905444283234307229507451","313060586440873120370651720879897346080","179628813643420249092244851467480958952","294044402362372968071973773776291328926","82444529623569954367138745627462777385","10816923921665173239582969620842208560","12521385020641654088268550922775167263"],"threshold":0.9},"id":"CVE-2026-57826-1ace426e","signature_type":"Line","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561","target":{"file":"pki/x509_common/src/hitls_x509_ctrl.c"}},{"source":"https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561","target":{"function":"X509_CheckExt","file":"pki/x509_verify/src/hitls_x509_verify.c"},"deprecated":false,"digest":{"function_hash":"236567384371838345056533975796539096362","length":1042},"id":"CVE-2026-57826-1da4bdf7","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["46474217730041487802036873746805685416","155120359709957393064108399890030525231","245240747210495634672789213916105517640","13991377680707901691718112720527374770"],"threshold":0.9},"id":"CVE-2026-57826-2c05936e","signature_type":"Line","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/2d3b221d113b452bc197012b185978b8314ee8a4","target":{"file":"include/pki/hitls_pki_errno.h"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561","target":{"file":"testcode/sdv/testcase/pki/verify/test_suite_sdv_x509_vfy.c","function":"SDV_X509_VFY_BC_CA_FALSE_FAIL_TC002"},"deprecated":false,"digest":{"function_hash":"44068194286585852474791222840072355209","length":1312},"id":"CVE-2026-57826-2e9fc741"},{"digest":{"function_hash":"262575290524268453221737041477127271285","length":2037},"id":"CVE-2026-57826-30016777","signature_type":"Function","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561","target":{"function":"HITLS_X509_Adapt_VerifyCertChain","file":"tls/cert/hitls_x509_adapt/hitls_x509_cert_chain.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"15152133893018693448605963907136215832","length":1345},"id":"CVE-2026-57826-39109173","signature_type":"Function","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/2d3b221d113b452bc197012b185978b8314ee8a4","target":{"file":"pki/x509_cert/src/hitls_x509_cert.c","function":"HITLS_X509_CheckIssued"}},{"deprecated":false,"digest":{"line_hashes":["112603092972669439073071709348431389549","45333322263627325358915098419294637874","278104788940496138286098615143184799230","333705918149629912892791536730255515569","118084063868891471452947166132795984940","267405983823211579336365784312835324230","78057525022722586752726356895554984814"],"threshold":0.9},"id":"CVE-2026-57826-3d4a1bcc","signature_type":"Line","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/3d29581401bff58e07bdbe551729ef24082134c5","target":{"file":"testcode/sdv/testcase/bsl/log/test_suite_sdv_log.c"}},{"target":{"file":"testcode/sdv/testcase/pki/verify/test_suite_sdv_x509_vfy.c"},"deprecated":false,"digest":{"line_hashes":["202957655401155067135837496974126220030","33848207997699288878527210463514810874","175396858593199542348771396564633043017","322093935989356941493118980615373014444","322165072339211498090076530228019536386","300935289773128504412262579888702593600","79664687922378113427056163524900707213","294479589205187008446451814390115786860","162454524210285704778871109457448223869","303573941276247036144260100847455800781","158128214927161026092321573120634131458","35764983878198171367723009958263747434","168448748725297015425736618893188034328","195066079447969365739320887530125198915","146809780475201466916900459101161114277","138475997627154080818109083138421383952","165775707376116254734398291179801776943","338456578670869273766027319776673633951","103732490272136014225544215191823045550","164232967910955234785844704119424441464","340130951893489325579157434629848675817","168448748725297015425736618893188034328","150593487085667219032377217657437077533","242277157034438047676121622306374509366","156785853587464473382145042355526544979","275417357095282424866601147255084963398","279034411011479620965543769626834072377","168448748725297015425736618893188034328","195066079447969365739320887530125198915","146809780475201466916900459101161114277","156785853587464473382145042355526544979","275417357095282424866601147255084963398","279034411011479620965543769626834072377","174643692601735721710140603933276048653","331302365200591993867643969385113451025","327916821862088190396126131316409446250","195066079447969365739320887530125198915","146809780475201466916900459101161114277","149738053833134408286541588568889730843","70935853682530872005822443784790652055","118729950234780099389003457859280630011","85723722234283012734281657771728151824"],"threshold":0.9},"id":"CVE-2026-57826-468d8065","signature_type":"Line","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/2d3b221d113b452bc197012b185978b8314ee8a4"},{"digest":{"function_hash":"264719905726785983975621384038169714102","length":659},"id":"CVE-2026-57826-49fbbd61","signature_type":"Function","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561","target":{"file":"pki/x509_verify/src/hitls_x509_verify.c","function":"HITLS_X509_CheckCertExt"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/2d3b221d113b452bc197012b185978b8314ee8a4","target":{"file":"pki/x509_cert/src/hitls_x509_cert.c"},"deprecated":false,"digest":{"line_hashes":["191045396002748479267662660437549348786","86415581533349504251143116982615536315","82211384002788854233399557479060129198","111421343437963010983791732224468899644","94705174880440147425694284690566222858","333724674655041937677395912022154170697","10021997456637312271701110210024347575","204405152005839647291648851258941831083","61623445101870679941255957313016476554","42071553526862499432055096156735270526","43817206756407178779565740017478637331","13247845763292517259057580755259767805"],"threshold":0.9},"id":"CVE-2026-57826-4cbcdf96"},{"signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/3d29581401bff58e07bdbe551729ef24082134c5","target":{"file":"testcode/sdv/testcase/bsl/log/test_suite_sdv_log.c","function":"SDV_BSL_LOG_VERSION_API_TC001"},"deprecated":false,"digest":{"function_hash":"270637039942798687104892108605963018524","length":505},"id":"CVE-2026-57826-50611a5d","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["315790939079636918061009003837359237850","255271608523270005765421533593910268727","272075516953960025337470904995416086640","90564585350722173461012196587620896584","296246019544814239701483498500539215226","190525291975956492574820951396687564895","196393589822299784830264783267586089078","108412984922357499080247129069303191099","87957395768404903892858782958579365874","105911130578414179728696708148410774568","239210608929042079839030885664101342011"],"threshold":0.9},"id":"CVE-2026-57826-577656d7","signature_type":"Line","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561","target":{"file":"tls/cert/hitls_x509_adapt/hitls_x509_cert_chain.c"}},{"signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561","target":{"file":"testcode/sdv/testcase/pki/verify/test_suite_sdv_x509_vfy.c"},"deprecated":false,"digest":{"line_hashes":["176451239042557364023479203239461008245","6974174570203097229784038650711971875","81785215860079558582442344448142120758","307473524193671859403490361988467217428","59973807865515942182490001390558263783","9651032638257471695131904126291778852","227281265466679435669712854894333752695","37830976057249115638877674089639063134","58490511734337335721177262896478842068","339260756367707459563327773994000015424","126018632983681760454654673220308432548","37830976057249115638877674089639063134","58490511734337335721177262896478842068","339260756367707459563327773994000015424","126018632983681760454654673220308432548","236591981208498526844148903371635740374"],"threshold":0.9},"id":"CVE-2026-57826-5ab29e64","signature_type":"Line"},{"target":{"file":"testcode/sdv/testcase/pki/cert/test_suite_sdv_x509_check.c"},"deprecated":false,"digest":{"line_hashes":["266785858383797155718985413231898141141","221633434076142650163074182557356281988","29787181170117340578178622427915482926","201580031092724647060973158023653875855","19294834157432369837267714805841426187","134719341786767764893652741235174329190"],"threshold":0.9},"id":"CVE-2026-57826-5c51b4ac","signature_type":"Line","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561"},{"signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561","target":{"file":"pki/x509_common/src/hitls_x509_ext.c","function":"HITLS_X509_ParseGeneralNames"},"deprecated":false,"digest":{"function_hash":"27725242658352856895452676755488957581","length":590},"id":"CVE-2026-57826-7d9f0bd1","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"3278375359832067197742605096386348579","length":789},"id":"CVE-2026-57826-834905bb","signature_type":"Function","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/2d3b221d113b452bc197012b185978b8314ee8a4","target":{"file":"pki/x509_verify/src/hitls_x509_verify.c","function":"HITLS_X509_CertVerify"}},{"deprecated":false,"digest":{"function_hash":"41675925701589190272520589549043049856","length":539},"id":"CVE-2026-57826-8ff4da3f","signature_type":"Function","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561","target":{"file":"pki/x509_common/src/hitls_x509_ctrl.c","function":"HITLS_X509_SetNameList"}},{"digest":{"function_hash":"140381006892022370104522507298262178842","length":1316},"id":"CVE-2026-57826-95e58d99","signature_type":"Function","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561","target":{"file":"testcode/sdv/testcase/pki/verify/test_suite_sdv_x509_vfy.c","function":"SDV_X509_VFY_BC_MISSING_FAIL_TC001"},"deprecated":false},{"id":"CVE-2026-57826-9adb0cf3","signature_type":"Function","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561","target":{"file":"testcode/sdv/testcase/pki/verify/test_suite_sdv_x509_vfy.c","function":"SDV_X509_VERIFY_CERT_CHAIN_FUNC_TC001"},"deprecated":false,"digest":{"function_hash":"200517083535276832774112824854119715308","length":1372}},{"digest":{"line_hashes":["236078359773830896750678731912805664908","6176601494402324879023179488161194960","1088564105819163183451395575861948182","240899209756401316643203633275268860341","281044313696515729673268526897423043219","276013670566491008220659437998576892497","290583897196074383234415864785169232598","317712776156005816857103881725520638926","195442824361941509839895040503077330503","57127856688381326847909164038631626407","97177496961593226936428595607001256767","131767179074099594275195365498732949940","248308435551079590908980458238744001446","173170593665915886082639351438074090080"],"threshold":0.9},"id":"CVE-2026-57826-bc82002c","signature_type":"Line","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561","target":{"file":"pki/x509_common/src/hitls_x509_ext.c"},"deprecated":false},{"digest":{"line_hashes":["172005144106640496532045473072526686534","84511574490792902822972908614242037182","301604952841215996832476235597114909683","34871137766558812414224174035957162424","252125829677389811627107176133958314774","260742094303550275039384685889963143300","288613477447251732889763318827052491618","208833744867474057558711475484580694048","252354251372825427988030989274180642600","213732363133935712555141545340340870168","290067162527754689887905078448878410398","19186937075821482550502994037156833069","70279695451631745042706284842573855199","13020401003528111843140556172097907583","10228690171976179310544038030321885730","270580777439555881259268517133354307783","215639954165386549460085448889022661693","308922075019763903027490200245237150957","54981106492966618474704182118841778714","167416482878068296705649107559015082282","213454840359826600722493318516110481793","250246620153375848967422191444098139170","21757727779391880450066963515551648452","38460112543619233638039332978417113613","30725769490942919198625791438199709538","8248300680391999492903890371085172958","173294748080882389011685452021448247226","295779887881397861862401368868465636975","82974375189792336357569125684902250","143551730081848345976886961638201678804","116701490017973812273616908674871228171","185059778161852339759699536424898188847","4382164892859185619483493290448366493","25016569884116889887273725751267828472"],"threshold":0.9},"id":"CVE-2026-57826-e1ab2735","signature_type":"Line","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561","target":{"file":"pki/x509_verify/src/hitls_x509_verify.c"},"deprecated":false},{"target":{"file":"include/pki/hitls_pki_errno.h"},"deprecated":false,"digest":{"line_hashes":["275707922327798243221746482276147835996","197713278040346553023229867975621330857","160365106892391309532068181886944167055","13991377680707901691718112720527374770","337589726955240955986015562747426792171","112768386443565385988132277740070729912","137632431053171334104279673456804294590","172319312984521850828148274866735367620"],"threshold":0.9},"id":"CVE-2026-57826-f1decad7","signature_type":"Line","signature_version":"v1","source":"https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}