CVE-2026-119345

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-119345

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-119345.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-119345

Aliases

GHSA-ghwv-vrp2-2975

Published

2026-11-05T15:53:42Z

Modified

2026-11-05T21:32:21Z

Severity

7.2 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks

Details

Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attached devices after that check can keep the existing connection open while the peer continues trusting stale initial Evidence. This gap is especially significant for long-lived connections because the verifier has no mechanism to detect the changed state. This issue is fixed in version 0.9.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-367"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119345.json"
}

References

Affected packages

Git / github.com/ultravioletrs/cocos

Affected ranges

Type

GIT

Repo

https://github.com/ultravioletrs/cocos

Events

Introduced

Fixed

b44780df95a34cf0906c6af9d06e94f56e4811f2

Fixed

80bf813c48300f02259b338b91f844c71be582ea

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.9.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "80bf813c48300f02259b338b91f844c71be582ea"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v0.9.0",
            "range": [
                {
                    "fixed": "b44780df95a34cf0906c6af9d06e94f56e4811f2"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*

v0.0.1

v0.0.2

v0.1.0

v0.2.0

v0.3.0

v0.3.1

v0.4.0

v0.5.0

v0.5.1

v0.5.2

v0.6.0

v0.7.0

v0.8.0

v0.8.1

v0.8.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-119345.json"