digitalbazaar forge vulnerabilities

CVEs per yearBy the year they were published

1. 20223
2. 20252
3. 202620

Newest CVEs

• CVE-2026-119191

  Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer

  digitalbazaar · forge

  High7.5
• CVE-2026-119190

  Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

  digitalbazaar · forge

  High7.4
• CVE-2026-119189

  Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage

  digitalbazaar · forge

  Medium5.9
• CVE-2026-119188

  Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message

  digitalbazaar · forge

  High7.5
• CVE-2026-119187

  Forge: Denial of service in TLS record processing via call stack exhaustion

  digitalbazaar · forge

  High7.5
• CVE-2026-119186

  Forge: AES-GCM authentication bypass via unvalidated tagLength option

  digitalbazaar · forge

  Medium5.9
• CVE-2026-118782

  Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

  digitalbazaar · forge

  High7.5
• CVE-2026-118781

  Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

  digitalbazaar · forge

  Low2.9
• CVE-2026-118780

  Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

  digitalbazaar · forge

  Low3.7
• CVE-2026-118779

  Forge: Regular expression denial of service in PEM decoding (pem.decode)

  digitalbazaar · forge

  High7.5