EUVD-2026-62218Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
MITM needs an active on-path position (AC:H) but no auth or user interaction (PR:N/UI:N); attacker can read and tamper upstream traffic (C:H/I:H) with no availability impact.
Primary rating from Vendor (LY-Corporation).
CVSS VectorVendor: LY-Corporation
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections.
AnalysisAI
Man-in-the-middle exposure in LINE's Armeria (armeria-xds module) versions prior to 1.41.0, where TLS peer (certificate) verification on xDS-managed upstream connections can be silently disabled, causing the client to trust unauthenticated or spoofed upstreams. Any attacker positioned on the network path between an armeria-xds client and its xDS-configured upstream service can intercept, read, and tamper with traffic that operators believe is protected by TLS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the application uses the armeria-xds module and that upstream TLS peer verification is in the silently-disabled state for the targeted xDS-managed upstream connection (the advisory describes verification being silently turned off for xDS-configured upstreams). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N) scores 9.1 (Critical), reflecting high confidentiality and integrity impact with no availability impact and no scope/subsequent-system change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the Armeria armeria-xds dependency to version 1.41.0 or later, which restores proper upstream TLS peer verification; this is the primary and recommended fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications running Armeria versions prior to 1.41.0 and document which services rely on xDS-managed upstream connections. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messag
Armeria is a microservice framework Spring supports Matrix variables. Rated high severity (CVSS 7.5), this vulnerability
Armeria is an open source microservice framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote a
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today