GHSA-mpwr-8vm7-h73f

Summary

package pkcs12: Authentication bypass in Decode functions

Severity

medium

CWE

CWE-20

Published

2026-08-17

Updated

2026-08-17

Advisory details

Decode, DecodeChain, DecodeTrustStore, and ToPEM can incorrectly accept PKCS#12 files which were encoded with the wrong password, due to a failure to reject excessively-short PBMAC1 keys. Users who decode PKCS#12 files from untrusted sources and rely on the password for authentication can be tricked into accepting malicious PKCS#12 files. Users who only decode PKCS#12 files from trusted sources are not affected.

Thanks to Pavol Žáčik (Red Hat) and Alex Gaynor (Anthropic) for finding and reporting the same issue in OpenSSL (CVE-2026-34181).

References

• https://github.com/advisories/GHSA-mpwr-8vm7-h73f
• https://github.com/SSLMate/go-pkcs12/security/advisories/GHSA-mpwr-8vm7-h73f
• https://openssl-library.org/news/vulnerabilities/#CVE-2026-34181

Related advisories

• CVE-2026-96620 — critical · PyPI/claude-agent-sdk
• CVE-2026-107726 — critical · Maven/com.hazelcast:hazelcast
• CVE-2026-55068 — critical · Go/github.com/free5gc/free5gc
• CVE-2026-54133 — critical · Packagist/mtdowling/jmespath.php
• GHSA-rjg6-39jm-rgg4 — critical · npm/@better-auth/scim
• CVE-2026-53713 — critical · Go/github.com/envoyproxy/gateway
• CVE-2026-53513 — critical · npm/@better-auth/sso
• CVE-2026-48769 — critical · Go/github.com/lxc/incus/v7/cmd/incusd

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity