CVE-2026-8367: aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued…

PriorityP427medium5.3CVSS 3.1

AVNACLPRNUINSUCNILAN

EPSS

0.13%

2.4th percentile

aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
aria2_project	aria2	< 1.37.0	1.37.0
aria2_project	aria2c	<= 1.37.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.