CVE-2026-8367
aria2c accepts a server certificate with incorrect Extended Key Usage (EKU).
Published May 13, 2026 · updated Aug 19, 2026 · aria2 project aria2
aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 13, 2026 · NIST NVD
Detected
aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
Aug 19, 2026 · NIST NVD
Updated
aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
Affected
- cpe aria2 project/aria2version unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-8367
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-8367
aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
nvd.nist.gov