{"id":"CVE-2026-58817","kind":"vulnerability","aliases":["CVE-2026-58817"],"related":[],"title":"Android: certificate parsing flaw allows permanent local denial of service","description":"In parseKnownActivityEmbeddingCerts of ParsingUtils.java, there is a possible permanent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A flaw in the parseKnownActivityEmbeddingCerts function in ParsingUtils.java causes a permanent denial of service through improper input validation. A local app or process can trigger it without extra privileges or user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:47+00:00","first_seen_at":"2026-11-02T20:35:30+00:00","triaged_at":"2026-11-02T20:39:13+00:00","updated_at":"2026-11-02T20:39:13+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-11-02T20:39:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android: certificate parsing flaw allows permanent local denial of service","impact":"low","summary":"A flaw in the parseKnownActivityEmbeddingCerts function in ParsingUtils.java causes a permanent denial of service through improper input validation. A local app or process can trigger it without extra privileges or user interaction.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android"],"confidence":0.3,"fix_status":"unknown","needs_auth":"no","worst_case":"device service becomes permanently unavailable until repaired","analyst_note":"Identify the affected product, versions and patch level from the NVD entry and the vendor bulletin; confirm whether ParsingUtils.java is Android framework code.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected product or version range; the code path is in ParsingUtils.java, which suggests an Android framework component, but this is not stated. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000611,"input_tokens":4109,"output_tokens":401,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-58817':13A,16A 'addit':77C 'allow':5A 'android':1A,17B 'app':38B 'caus':26B 'certif':2A 'could':68C 'cve':11A,14A 'denial':8A,29B,59C,72C 'due':62C 'execut':78C 'exploit':87C 'extra':45B 'flaw':4A,19B 'function':23B 'improp':33B,64C 'input':34B,65C 'interact':49B,82C 'lead':69C 'local':7A,37B,71C 'need':80C,85C 'pars':3A 'parseknownactivityembeddingcert':22B,51C 'parsingutils.java':25B,53C 'perman':6A,28B,58C 'possibl':57C 'privileg':46B,79C 'process':40B 'servic':10A,31B,61C,74C 'trigger':42B 'user':48B,81C 'valid':35B,66C 'without':44B","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected product or version range; the code path is in ParsingUtils.java, which suggests an Android framework component, but this is not stated. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","other","unknown"],"first_public_at":"2026-11-02T20:17:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58817","severity":null,"published_at":"2026-11-02T20:17:47+00:00","modified_at":"2026-11-02T20:17:47+00:00","first_seen_at":"2026-11-02T20:35:30+00:00","fetched_at":"2026-11-02T20:35:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}