CVE-2026-55960

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An issue exists where an un-negotiated Raw Public Key (RPK), as defined in RFC 7250, is accepted instead of an X.509 certificate, allowing the bypass of chain validation. Because a raw public key lacks a chain, the ParseCertRelative() function accepts it without performing trust verification. This should only occur when RPK is explicitly negotiated for the peer. The system now defaults the expected type to X.509 when no type is negotiated and rejects mismatches, including un-negotiated raw public keys, with an UNSUPPORTED CERTIFICATE error. This issue only affects builds where Raw Public Key support (HAVE RPK) is enabled, which occurs when using the --enable-all configuration rather than a standalone build.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.