Channel-binding downgrade in `com (CVE-2026-53712)

CVE-2026-53712 is a channel-binding downgrade vulnerability in `com.ongres.scram:scram-client` that allows a TLS man-in-the-middle attacker to silently downgrade authentication from `SCRAM-SHA-256-PLUS` (with channel binding) to `SCRAM-SHA-256` (without channel binding). The flaw occurs when a server presents an X.509 certificate using a signature algorithm without traditional `WITH` naming (e.g., Ed25519 or post-quantum algorithms), causing `TlsServerEndpoint` to swallow a `NoSuchAlgorithmException` and return an empty byte array, which the client misinterprets as an absence of channel binding support. This bypasses strict client-side channel binding enforcement policies and affects deployments configured with `channelBinding=require`. Affected versions: - com.ongres.scram:scram-client <= 3.2 - com.ongres.scram:scram-common <= 3.2 We recommend updating to: 3.3. CVSS 8.2 · our assessment: this_week Vendor advisory: https://github.com/ongres/scram/security/advisories/GHSA-p9jg-fcr6-3mhf Details: https://vuln.today/cve/CVE-2026-53712