CVE-2026-108361

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108361
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108361.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108361
Aliases
  • GHSA-gg8q-mfhh-wrrc
Published
2026-10-12T19:06:20Z
Modified
2026-10-14T07:12:32Z
Severity
  • 7.2 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Privasys Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
Details

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully appraised and the connection was established, there was a window of vulnerability from the establishment of the connection to the termination of the connection where an attacker could modify the state of the workload and platform at runtime on the TLS endpoint acting as the Attester. This vulnerability was possible because Privasys/ra-tls-clients performed attestation only once in the lifetime of the connection (at connection establishment time), and the verifying peer continued to believe that the state was the same as in the initial Evidence throughout, whereas it could be stale at some point in time. This vulnerability is fixed in 0.9.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-367"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108361.json"
}
References

Affected packages

Git / github.com/privasys/ra-tls-clients

Affected ranges

Type
GIT
Repo
https://github.com/privasys/ra-tls-clients
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b9114d772a636ad3307957dde4bb8afe70c9b40d
Fixed
076074873117ee5ff35a7c39e02952c28de3df0c
Fixed
5ccfd778132e17cb54bb1a9c7b89d57fcfea59ec
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.9.1"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.2.0
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9
v0.5.0
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.8.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108361.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "156025898876379687137301652891719226021",
                "82525551586038404051264686819874859333",
                "213756708603611915372840886512984777561"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-108361-be203bcf",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/privasys/ra-tls-clients/commit/076074873117ee5ff35a7c39e02952c28de3df0c",
        "target":  {
            "file":  "rust/mobile/include/ratls_mobile.h"
        }
    }
]
vanir_signatures_modified 
"2026-10-14T07:12:32Z"