{"id":"CVE-2026-8367","summary":"aria2c Improper Certificate Validation","details":"aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.","modified":"2026-08-21T03:47:10.980566350Z","published":"2026-05-13T14:55:09.815Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"last_affected":"1.37.0"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"tenable","cwe_ids":["CWE-295"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8367.json"},"references":[{"type":"WEB","url":"https://www.tenable.com/security/research/tra-2026-38"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8367.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8367"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/aria2/aria2","events":[{"introduced":"0"},{"fixed":"02f2d0d8472b3c38c29b4dba8c75ebd5fdd2899a"}],"database_specific":{"cpe":"cpe:2.3:a:aria2_project:aria2:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.37.0"}],"source":"CPE_RANGE"}}],"versions":["release-1.36.0","release-1.35.0","release-1.34.0","release-1.33.0","release-1.32.0","release-1.31.0","release-1.30.0","release-1.29.0","release-1.28.0","release-1.27.1","release-1.27.0","release-1.26.0","release-1.25.0","release-1.24.0","release-1.23.0","release-1.22.0","release-1.21.0","release-1.20.0","release-1.19.3","release-1.19.2","release-1.19.1","release-1.19.0","release-1.18.10","release-1.18.9","release-1.18.8","release-1.18.7","release-1.18.6","release-1.18.5","release-1.18.4","release-1.18.3","release-1.18.2","release-1.18.1","release-1.18.0","release-1.17.1","release-1.17.0","release-1.16.5","release-1.16.4","release-1.16.3","release-1.16.2","release-1.16.1","release-1.16.0","release-1.15.2","release-1.15.1","release-1.15.0","release-1.14.2","release-1.14.1","release-1.14.0","release-1.13.0","release-1.12.1","release-1.12.0","release-1.11.2","release-1.11.1","release-1.11.0","release-1.10.9","release-1.10.8","release-1.10.7"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8367.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}