Certvalidator
Monthly
Resource exhaustion in the Certificate Path Builder of wbond certvalidator 0.11.1 and earlier lets unauthenticated remote attackers degrade availability by supplying crafted X.509 certificate chains for validation, consuming excessive CPU and/or memory (CWE-400, availability-only impact). The flaw is only reachable where a deploying application feeds attacker-controlled certificates into the library - for example mutual-TLS client certificates, PKCS#7 or document-signature verification, or any workflow that validates externally supplied chains - and is not remotely reachable in applications that never process external certificates. No vendor-released patch is available (the vendor was contacted but did not respond), and no public exploit code has been identified at time of analysis; EPSS data was not provided.
Resource exhaustion in the Certificate Path Builder of wbond certvalidator 0.11.1 and earlier lets unauthenticated remote attackers degrade availability by supplying crafted X.509 certificate chains for validation, consuming excessive CPU and/or memory (CWE-400, availability-only impact). The flaw is only reachable where a deploying application feeds attacker-controlled certificates into the library - for example mutual-TLS client certificates, PKCS#7 or document-signature verification, or any workflow that validates externally supplied chains - and is not remotely reachable in applications that never process external certificates. No vendor-released patch is available (the vendor was contacted but did not respond), and no public exploit code has been identified at time of analysis; EPSS data was not provided.