Improper Certificate Validation in OkHttp Affects Network Security
CVE-2026-129482

6.3MEDIUM

Key Information:

Vendor

Square

Status
Okhttp
Vendor
CVE Published:
15 November 2026

What is CVE-2026-129482?

The vulnerability in OkHttp allows attackers to intercept or modify TLS traffic due to improper certificate validation in the CertificatePinner component. This occurs because the Pin.matchesHostname function fails to properly handle trailing-dot hostnames. As a result, network attackers can exploit this weakness if they possess a CA-trusted certificate that doesn't match the configured pins. Applications requesting the trailing-dot form of pinned hosts are especially susceptible, posing a significant threat to data integrity and confidentiality.

Affected Version(s)

OkHttp 0 <= 5.5.1

References

https://github.com/lysine-dev/okhttp/issues/9724
issue-tracking
https://github.com/lysine-dev/okhttp/pull/9734
patchissue-tracking
https://github.com/lysine-dev/okhttp/commit/30aa589761a9b...
patch

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers
.