CVE-2026-129118 · Package
NO FIX YET · SEE WHAT TO DO
C-Kermit mishandles hostname checks in its TLS certificate code, so names containing asterisks, question marks, brackets or empty labels match when they should not. An attacker holding a trusted certificate with such names can intercept credentials and data sent over Telnet, FTP and HTTP TLS connections.
first public Oct 31, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running C-Kermit 8.0.200 through 11.1.514 to make TLS connections over Telnet, FTP or HTTP. The attacker needs a publicly trusted certificate with over-matching names, so the risk is mainly to sessions where a client trusts certificates from a rogue or compromised issuer. Systems that do not use C-Kermit for TLS sessions can skip it.
Not affected if no-tls-use, versions-outside-range
Who cares c-kermit, ftp, telnet, tls
kermit -v or the package manager; affected versions are 8.0.200 up to but not including 11.1.515.11.1.515 or later (per the NVD range, fixed in 11.1.515).C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by abusing wildcard matching in dNSName_cmp() in ck_ssl.c. Attackers holding a trusted certificate with over-matching names containing asterisks, question marks, brackets, or empty labels can intercept credentials and data over Telnet, FTP, and HTTP TLS connections.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.