Threat database

CVE-2026-108266 is a critical origin validation error in the Privasys rustls library prior to version 0.8.1. The vulnerability involves RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. This flaw allows an attacker with access to an enclave TLS private key to relay a genuine quote onto another connection, causing a relying party to mistakenly accept an attacker-terminated connection as if it were from the attested enclave. The issue is fixed in Privasys rustls version 0.8.1.

A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.