DEBIAN-CVE-2026-109144

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-109144

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-109144.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-109144

Upstream

CVE-2026-109144

Published

2026-10-13T10:17:14Z

Modified

2026-10-17T17:00:10Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

[none]

Details

A vulnerability was identified in wbond certvalidator up to 0.11.1. This issue affects some unknown processing of the component Certificate Path Builder. Such manipulation leads to resource consumption. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

References

https://security-tracker.debian.org/tracker/CVE-2026-109144

Affected packages

Debian:13 / python-certvalidator

Package

Name: python-certvalidator
Purl: pkg:deb/debian/python-certvalidator?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.11.1-4

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-109144.json"

Debian:14 / python-certvalidator