Threat Intelligence Database

trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS (aTLS) Intel TDX verification path does not copy the expected current-session freshness value into the TDX quote-body policy before quote validation, so structurally valid TDX QuoteV4 Evidence is accepted without checking that its REPORT_DATA field matches the reportData expected for the current session. A relying party using this path can therefore accept Evidence with a mismatched or reused reportData and release application data after the handshake, enabling session-misbinding to an unintended attestation context. The issue is fixed in version 0.9.0.

CVE-2026-92702 is a critical origin validation vulnerability in ultravioletrs cocos, a confidential computing system for AI workloads. Versions up to and including 0.8.2 do not enforce attestation freshness in the intra-handshake attested TLS AMD SEV-SNP verification path when the expected reportData is nil, empty, or omitted. This allows acceptance of unrelated or stale attestation evidence, potentially causing a relying party to trust an unintended attestation context. The issue is fixed in version 0.9.0.