aria2c CVE-2026-8367

Apply a patched version of aria2c released by the aria2 project that properly validates EKU extensions during TLS server authentication-exact patched version numbers are not provided in available data, so consult the aria2 project's official releases and the Tenable advisory for version guidance. In the interim, minimize risk by downloading files only over trusted, isolated networks (e.g., corporate intranets with certificate pinning); restricting aria2c usage to environments where the server's identity can be independently verified out-of-band; or using aria2c with a custom CA bundle that includes only trusted root CAs known to issue certificates with correct EKU constraints. Organizations that cannot immediately patch should audit their aria2c deployments to identify which servers and URLs are routinely accessed, then apply network-level compensating controls such as TLS inspection proxies or firewall rules that enforce certificate validation-noting that such controls add latency and may interfere with legitimate server changes. The most effective near-term control is to restrict aria2c to authenticated, secured environments until patches are available.