CVE-2026-40097
2 advisories.
Go/github.com/smallstep/certificates CVE-2026-40097: low 3.7
Step CA affected by an index out of bounds panic in TPM attestation EKU validation
Action: Upgrade github.com/smallstep/certificates to 0.30.0 or later.
go get github.com/smallstep/certificates@v0.30.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.24.0 | 0.30.0 | - |
Fixed versions
| 0.30.0 |
Sources
- osv: GHSA-9qq8-cgcv-qmc9
- https://github.com/smallstep/certificates/security/advisories/GHSA-9qq8-cgcv-qmc9
- https://nvd.nist.gov/vuln/detail/CVE-2026-40097
- https://github.com/smallstep/certificates/pull/2569
- https://github.com/smallstep/certificates/commit/ffd31ac0a87e03b0224cb8363094bfe602242888
- https://github.com/smallstep/certificates
- https://github.com/smallstep/certificates/releases/tag/v0.30.0
CVE-2026-40097 · published · modified · JSON
Go/github.com/smallstep/certificates CVE-2026-40097: unknown
Step CA affected by an index out of bounds panic in TPM attestation EKU validation in github.com/smallstep/certificates
Action: Upgrade github.com/smallstep/certificates to 0.30.0 or later.
go get github.com/smallstep/certificates@v0.30.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.24.0 | 0.30.0 | - |
Fixed versions
| 0.30.0 |
Sources
- osv: GO-2026-5297
- https://github.com/smallstep/certificates/security/advisories/GHSA-9qq8-cgcv-qmc9
- https://nvd.nist.gov/vuln/detail/CVE-2026-40097
- https://github.com/smallstep/certificates/commit/ffd31ac0a87e03b0224cb8363094bfe602242888
- https://github.com/smallstep/certificates/pull/2569
- https://github.com/smallstep/certificates/releases/tag/v0.30.0
CVE-2026-40097 · published · modified · JSON