Vulnerability in aria2c TLS Server Authentication Due to Improper EKU Handling by Vendor
CVE-2026-8367

4.8MEDIUM

Key Information:

Vendor

Aria2 Project

Status
Aria2c
Vendor
CVE Published:
13 May 2026

What is CVE-2026-8367?

The aria2c tool has a vulnerability that arises from its acceptance of a server certificate with an incorrect Extended Key Usage (EKU). This flaw could allow attackers to exploit a compromised certificate, originally issued for different purposes, and use it for TLS server authentication. Such misuse poses a risk to secure connections, potentially undermining the integrity of communications.

Affected Version(s)

aria2c 0 <= 1.37.0

References

https://www.tenable.com/security/research/tra-2026-38

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.