Skip to content
OpenAdvisories

Weakness (CWE)

CWE-297: Improper Validation of Certificate with Host Mismatch

Variant Incomplete

The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

How to prevent it (3 mitigations)

  1. Architecture and Design

    In order to ensure data integrity, the certificate must be valid, and it must pertain to the site that is being accessed.Fully check the hostname of the certificate and provide the user with adequate information about the nature of the problem and how to proceed.

  2. Implementation

    If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

  3. Implementation

    Be careful of other weaknesses in the code that checks the hostname, since it is still possible to incorrectly check the hostname. For example, attackers could create a certificate with a name that begins with a trusted name followed by a NUL byte, which could cause some string-based comparisons to only examine the portion that contains the trusted name.

Source: MITRE CWE-297

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.6
    CVE-2026-19553 Public exploit

    SSLContext.wrap_bio() missing validation of server_hostname parameter

    ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be si…

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Alpine
  • Medium 6.3
    CVE-2026-58040 Public exploit

    An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across iden…

    nodejs node nodejs nodejs Debian Ubuntu Alpine
  • Medium 6.8
    CVE-2026-22747 Public exploit

    Unauthorized User Impersonation when Using X.509 Client Certificates

    Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an…

    Spring Spring Security org.springframework.security:spring-security-web Maven
  • Critical 9.8
    CVE-2025-46408 Public exploit

    An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_Ht…

  • Medium 6.5
    CVE-2024-32868 Public exploit

    ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

    ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password ch…

    zitadel zitadel github.com/zitadel/zitadel Go
  • High 8.1
    CVE-2018-10936 Public exploit

    Moderate severity vulnerability that affects org.postgresql:pgjdbc-aggregate

    A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker coul…

    [UNKNOWN] PostgreSQL libpgjava libpgjava Debian Ubuntu Maven