CVE-2026-109144

5.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-400, CWE-404

Impact

Remote, unauthenticated attackers can cause denial of service via uncontrolled resource consumption. They only need network access to submit certificates to an application using this library.

Root cause

The Certificate Path Builder component improperly handles specific certificate inputs, triggering excessive resource consumption.

Affected systems

wbond certvalidator up to 0.11.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Fix & remediation

No fixed version is currently available as the vendor did not respond. Restrict or rate-limit untrusted certificate processing, or switch to an actively maintained fork such as pyhanko-certvalidator if patching cannot wait.

shell

$ pip show certvalidator

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A vulnerability was identified in wbond certvalidator up to 0.11.1. This issue affects some unknown processing of the component Certificate Path Builder. Such manipulation leads to resource consumption. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109144