Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
Victoria Metrics may accept resumed TLS sessions after CA changes
published 10 days ago
Summary
Victoria Metrics can mistakenly allow a previously established encrypted connection to continue even if the list of trusted certificate authorities is changed in the meantime. This could let an unauthorized party keep a session that should have been terminated. Update to the latest version of Victoria Metrics or ensure that CA lists are not modified while connections are active.
What to do
- Update cleanstart victoria-metrics to version 1.132.0-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | victoria-metrics |
< 1.132.0-r0 Fix: upgrade to 1.132.0-r0
|
Original advisory text
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...
Security vulnerability affects the victoria-metrics package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published9 Oct 2026
Updated9 Oct 2026
First seen9 Oct 2026
Sources
CLEANSTART-2026-DY81609 · OSV
Track software like this
Free during beta