CVE-2026-57826
- Source
- https://cve.org/CVERecord?id=CVE-2026-57826
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57826.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-57826
- Published
- 2026-08-18T00:00:00Z
- Modified
- 2026-09-02T08:05:29Z
- Severity
-
- 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
An issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermediate CAs are only verified for v3 certificates, and v1/v2 certificates are ignored.
- Database specific
{ "cna_assigner": "mitre", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57826.json" }- References
-
- https://gitcode.com/openHiTLS/openhitls/pull/1399
- https://gitcode.com/openHiTLS/openhitls/pull/1657
- https://github.com/openHiTLS/openHiTLS/compare/openhitls-0.3.2...openhitls-0.3.3
- https://www.openhitls.net/zh/support/HTLS-2026-001.html
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57826.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-57826
- https://github.com/openHiTLS/openHiTLS/commit/2d3b221d113b452bc197012b185978b8314ee8a4
- https://github.com/openHiTLS/openHiTLS/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561
Affected packages
Git / github.com/openhitls/openhitls
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57826.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"275746497929267116822623929922228215202",
"124183931371220500844350373075088263275",
"298435252645922132069982609850192493177",
"332904512092456905444283234307229507451",
"313060586440873120370651720879897346080",
"179628813643420249092244851467480958952",
"294044402362372968071973773776291328926",
"82444529623569954367138745627462777385",
"10816923921665173239582969620842208560",
"12521385020641654088268550922775167263"
],
"threshold": 0.9
},
"id": "CVE-2026-57826-1ace426e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561",
"target": {
"file": "pki/x509_common/src/hitls_x509_ctrl.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "236567384371838345056533975796539096362",
"length": 1042
},
"id": "CVE-2026-57826-1da4bdf7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561",
"target": {
"file": "pki/x509_verify/src/hitls_x509_verify.c",
"function": "X509_CheckExt"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"46474217730041487802036873746805685416",
"155120359709957393064108399890030525231",
"245240747210495634672789213916105517640",
"13991377680707901691718112720527374770"
],
"threshold": 0.9
},
"id": "CVE-2026-57826-2c05936e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/2d3b221d113b452bc197012b185978b8314ee8a4",
"target": {
"file": "include/pki/hitls_pki_errno.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "44068194286585852474791222840072355209",
"length": 1312
},
"id": "CVE-2026-57826-2e9fc741",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561",
"target": {
"file": "testcode/sdv/testcase/pki/verify/test_suite_sdv_x509_vfy.c",
"function": "SDV_X509_VFY_BC_CA_FALSE_FAIL_TC002"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "262575290524268453221737041477127271285",
"length": 2037
},
"id": "CVE-2026-57826-30016777",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561",
"target": {
"file": "tls/cert/hitls_x509_adapt/hitls_x509_cert_chain.c",
"function": "HITLS_X509_Adapt_VerifyCertChain"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "15152133893018693448605963907136215832",
"length": 1345
},
"id": "CVE-2026-57826-39109173",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/2d3b221d113b452bc197012b185978b8314ee8a4",
"target": {
"file": "pki/x509_cert/src/hitls_x509_cert.c",
"function": "HITLS_X509_CheckIssued"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"112603092972669439073071709348431389549",
"45333322263627325358915098419294637874",
"278104788940496138286098615143184799230",
"333705918149629912892791536730255515569",
"118084063868891471452947166132795984940",
"267405983823211579336365784312835324230",
"78057525022722586752726356895554984814"
],
"threshold": 0.9
},
"id": "CVE-2026-57826-3d4a1bcc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/3d29581401bff58e07bdbe551729ef24082134c5",
"target": {
"file": "testcode/sdv/testcase/bsl/log/test_suite_sdv_log.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"202957655401155067135837496974126220030",
"33848207997699288878527210463514810874",
"175396858593199542348771396564633043017",
"322093935989356941493118980615373014444",
"322165072339211498090076530228019536386",
"300935289773128504412262579888702593600",
"79664687922378113427056163524900707213",
"294479589205187008446451814390115786860",
"162454524210285704778871109457448223869",
"303573941276247036144260100847455800781",
"158128214927161026092321573120634131458",
"35764983878198171367723009958263747434",
"168448748725297015425736618893188034328",
"195066079447969365739320887530125198915",
"146809780475201466916900459101161114277",
"138475997627154080818109083138421383952",
"165775707376116254734398291179801776943",
"338456578670869273766027319776673633951",
"103732490272136014225544215191823045550",
"164232967910955234785844704119424441464",
"340130951893489325579157434629848675817",
"168448748725297015425736618893188034328",
"150593487085667219032377217657437077533",
"242277157034438047676121622306374509366",
"156785853587464473382145042355526544979",
"275417357095282424866601147255084963398",
"279034411011479620965543769626834072377",
"168448748725297015425736618893188034328",
"195066079447969365739320887530125198915",
"146809780475201466916900459101161114277",
"156785853587464473382145042355526544979",
"275417357095282424866601147255084963398",
"279034411011479620965543769626834072377",
"174643692601735721710140603933276048653",
"331302365200591993867643969385113451025",
"327916821862088190396126131316409446250",
"195066079447969365739320887530125198915",
"146809780475201466916900459101161114277",
"149738053833134408286541588568889730843",
"70935853682530872005822443784790652055",
"118729950234780099389003457859280630011",
"85723722234283012734281657771728151824"
],
"threshold": 0.9
},
"id": "CVE-2026-57826-468d8065",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/2d3b221d113b452bc197012b185978b8314ee8a4",
"target": {
"file": "testcode/sdv/testcase/pki/verify/test_suite_sdv_x509_vfy.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "264719905726785983975621384038169714102",
"length": 659
},
"id": "CVE-2026-57826-49fbbd61",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561",
"target": {
"file": "pki/x509_verify/src/hitls_x509_verify.c",
"function": "HITLS_X509_CheckCertExt"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"191045396002748479267662660437549348786",
"86415581533349504251143116982615536315",
"82211384002788854233399557479060129198",
"111421343437963010983791732224468899644",
"94705174880440147425694284690566222858",
"333724674655041937677395912022154170697",
"10021997456637312271701110210024347575",
"204405152005839647291648851258941831083",
"61623445101870679941255957313016476554",
"42071553526862499432055096156735270526",
"43817206756407178779565740017478637331",
"13247845763292517259057580755259767805"
],
"threshold": 0.9
},
"id": "CVE-2026-57826-4cbcdf96",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/2d3b221d113b452bc197012b185978b8314ee8a4",
"target": {
"file": "pki/x509_cert/src/hitls_x509_cert.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "270637039942798687104892108605963018524",
"length": 505
},
"id": "CVE-2026-57826-50611a5d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/3d29581401bff58e07bdbe551729ef24082134c5",
"target": {
"file": "testcode/sdv/testcase/bsl/log/test_suite_sdv_log.c",
"function": "SDV_BSL_LOG_VERSION_API_TC001"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"315790939079636918061009003837359237850",
"255271608523270005765421533593910268727",
"272075516953960025337470904995416086640",
"90564585350722173461012196587620896584",
"296246019544814239701483498500539215226",
"190525291975956492574820951396687564895",
"196393589822299784830264783267586089078",
"108412984922357499080247129069303191099",
"87957395768404903892858782958579365874",
"105911130578414179728696708148410774568",
"239210608929042079839030885664101342011"
],
"threshold": 0.9
},
"id": "CVE-2026-57826-577656d7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561",
"target": {
"file": "tls/cert/hitls_x509_adapt/hitls_x509_cert_chain.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"176451239042557364023479203239461008245",
"6974174570203097229784038650711971875",
"81785215860079558582442344448142120758",
"307473524193671859403490361988467217428",
"59973807865515942182490001390558263783",
"9651032638257471695131904126291778852",
"227281265466679435669712854894333752695",
"37830976057249115638877674089639063134",
"58490511734337335721177262896478842068",
"339260756367707459563327773994000015424",
"126018632983681760454654673220308432548",
"37830976057249115638877674089639063134",
"58490511734337335721177262896478842068",
"339260756367707459563327773994000015424",
"126018632983681760454654673220308432548",
"236591981208498526844148903371635740374"
],
"threshold": 0.9
},
"id": "CVE-2026-57826-5ab29e64",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561",
"target": {
"file": "testcode/sdv/testcase/pki/verify/test_suite_sdv_x509_vfy.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"266785858383797155718985413231898141141",
"221633434076142650163074182557356281988",
"29787181170117340578178622427915482926",
"201580031092724647060973158023653875855",
"19294834157432369837267714805841426187",
"134719341786767764893652741235174329190"
],
"threshold": 0.9
},
"id": "CVE-2026-57826-5c51b4ac",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561",
"target": {
"file": "testcode/sdv/testcase/pki/cert/test_suite_sdv_x509_check.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "27725242658352856895452676755488957581",
"length": 590
},
"id": "CVE-2026-57826-7d9f0bd1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561",
"target": {
"file": "pki/x509_common/src/hitls_x509_ext.c",
"function": "HITLS_X509_ParseGeneralNames"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "3278375359832067197742605096386348579",
"length": 789
},
"id": "CVE-2026-57826-834905bb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/2d3b221d113b452bc197012b185978b8314ee8a4",
"target": {
"file": "pki/x509_verify/src/hitls_x509_verify.c",
"function": "HITLS_X509_CertVerify"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "41675925701589190272520589549043049856",
"length": 539
},
"id": "CVE-2026-57826-8ff4da3f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561",
"target": {
"file": "pki/x509_common/src/hitls_x509_ctrl.c",
"function": "HITLS_X509_SetNameList"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "140381006892022370104522507298262178842",
"length": 1316
},
"id": "CVE-2026-57826-95e58d99",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561",
"target": {
"file": "testcode/sdv/testcase/pki/verify/test_suite_sdv_x509_vfy.c",
"function": "SDV_X509_VFY_BC_MISSING_FAIL_TC001"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "200517083535276832774112824854119715308",
"length": 1372
},
"id": "CVE-2026-57826-9adb0cf3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561",
"target": {
"file": "testcode/sdv/testcase/pki/verify/test_suite_sdv_x509_vfy.c",
"function": "SDV_X509_VERIFY_CERT_CHAIN_FUNC_TC001"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"236078359773830896750678731912805664908",
"6176601494402324879023179488161194960",
"1088564105819163183451395575861948182",
"240899209756401316643203633275268860341",
"281044313696515729673268526897423043219",
"276013670566491008220659437998576892497",
"290583897196074383234415864785169232598",
"317712776156005816857103881725520638926",
"195442824361941509839895040503077330503",
"57127856688381326847909164038631626407",
"97177496961593226936428595607001256767",
"131767179074099594275195365498732949940",
"248308435551079590908980458238744001446",
"173170593665915886082639351438074090080"
],
"threshold": 0.9
},
"id": "CVE-2026-57826-bc82002c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561",
"target": {
"file": "pki/x509_common/src/hitls_x509_ext.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"172005144106640496532045473072526686534",
"84511574490792902822972908614242037182",
"301604952841215996832476235597114909683",
"34871137766558812414224174035957162424",
"252125829677389811627107176133958314774",
"260742094303550275039384685889963143300",
"288613477447251732889763318827052491618",
"208833744867474057558711475484580694048",
"252354251372825427988030989274180642600",
"213732363133935712555141545340340870168",
"290067162527754689887905078448878410398",
"19186937075821482550502994037156833069",
"70279695451631745042706284842573855199",
"13020401003528111843140556172097907583",
"10228690171976179310544038030321885730",
"270580777439555881259268517133354307783",
"215639954165386549460085448889022661693",
"308922075019763903027490200245237150957",
"54981106492966618474704182118841778714",
"167416482878068296705649107559015082282",
"213454840359826600722493318516110481793",
"250246620153375848967422191444098139170",
"21757727779391880450066963515551648452",
"38460112543619233638039332978417113613",
"30725769490942919198625791438199709538",
"8248300680391999492903890371085172958",
"173294748080882389011685452021448247226",
"295779887881397861862401368868465636975",
"82974375189792336357569125684902250",
"143551730081848345976886961638201678804",
"116701490017973812273616908674871228171",
"185059778161852339759699536424898188847",
"4382164892859185619483493290448366493",
"25016569884116889887273725751267828472"
],
"threshold": 0.9
},
"id": "CVE-2026-57826-e1ab2735",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561",
"target": {
"file": "pki/x509_verify/src/hitls_x509_verify.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"275707922327798243221746482276147835996",
"197713278040346553023229867975621330857",
"160365106892391309532068181886944167055",
"13991377680707901691718112720527374770",
"337589726955240955986015562747426792171",
"112768386443565385988132277740070729912",
"137632431053171334104279673456804294590",
"172319312984521850828148274866735367620"
],
"threshold": 0.9
},
"id": "CVE-2026-57826-f1decad7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openhitls/openhitls/commit/4355cdf5b043d5b9ef698f8f57860f77f8e92561",
"target": {
"file": "include/pki/hitls_pki_errno.h"
}
}
]
vanir_signatures_modified
"2026-09-02T08:05:29Z"