Is there a patch available for CVE-2025-44005?

Yes, a patch is available for CVE-2025-44005. Update the affected software to the latest version immediately.

step-certificates CVE-2025-44005

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:33 vuln.today

DescriptionCVE.org

Alpine Linux: step-certificates fixed in 0.29.0-r0

AnalysisAI

step-certificates on Alpine Linux contains a vulnerability patched in package version 0.29.0-r0. The underlying nature of the flaw - whether it affects certificate issuance, authentication flows, ACME protocol handling, or the CA signing logic - is not disclosed in available intelligence. The Alpine Linux vendor advisory confirms the fix, and the low EPSS score of 0.03% (9th percentile) indicates minimal observed exploitation activity at time of analysis.

Technical ContextAI

step-certificates is Smallstep's open-source certificate authority and PKI automation toolkit, commonly deployed to issue and manage TLS certificates via ACME, JWK, OIDC, and other provisioners. The affected component is the Alpine Linux distribution package of step-certificates. No CWE classification is available in the provided data, so the root cause class - whether memory safety, logic error, authentication bypass, cryptographic weakness, or other - cannot be determined. No CPE strings were provided; the affected artifact is the Alpine Linux apk package 'step-certificates' prior to version 0.29.0-r0.

Affected ProductsAI

The affected product is the Alpine Linux package step-certificates in all versions prior to 0.29.0-r0. The fix is confirmed in Alpine Linux package version 0.29.0-r0. No CPE strings are available in the provided data. Systems running Alpine Linux with step-certificates installed and not yet updated to 0.29.0-r0 are potentially affected. The upstream Smallstep step-certificates project version corresponding to this Alpine package version is not independently confirmed from the available data.

RemediationAI

Update the Alpine Linux step-certificates package to version 0.29.0-r0 or later using the standard Alpine package manager: 'apk upgrade step-certificates'. This is the vendor-confirmed fix per the Alpine Linux advisory. No specific workarounds are documented in the available intelligence. Because the vulnerability type is undisclosed, specific compensating controls cannot be responsibly recommended without risking incomplete mitigation. Administrators should consult the Alpine Linux security advisories and the upstream Smallstep project release notes for additional context on exposure and interim mitigations.