CVE-2026-31839
Integrity Bypass in Striae Digital Confirmation Allows Tampering
Publication date: 2026-03-11
Last updated on: 2026-03-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| striae | striae | From 0.9.22 (inc) to 3.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-354 | The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-31839 is a high-severity integrity bypass vulnerability in the Striae firearms examiner's comparison companion software prior to version 3.0.0. The vulnerability exists in Striae's digital confirmation workflow, where hash-only validation trusted manifest hash fields that could be modified together with the package content. This means an attacker with access to an exported package could alter both the confirmation data and recompute the hashes, allowing tampered confirmation packages to pass integrity checks undetected."}, {'type': 'paragraph', 'content': 'This flaw compromises the immutability and forensic chain-of-custody guarantees that users rely on for digital confirmations. The vulnerability was fixed in version 3.0.0 by replacing hash-only validation with server-issued asymmetric signatures for forensic manifests and enforcing fail-closed verification to prevent acceptance of tampered or unsigned confirmation packages.'}] [1, 2]
How can this vulnerability impact me? :
This vulnerability can severely impact the integrity and trustworthiness of digital confirmation packages used in forensic workflows. An attacker could modify both the content and its associated hash, causing tampered packages to pass integrity checks undetected.
As a result, the immutability and chain-of-custody assurances are broken, potentially leading to acceptance of falsified or altered forensic evidence. This undermines forensic accountability and could lead to incorrect conclusions or legal challenges.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying the use of hash-only validation in Striae confirmation packages, which is vulnerable to tampering. Since the vulnerability allows modified confirmation packages to pass integrity checks by altering both content and hash fields, one indicator is the presence of confirmation packages validated solely by hashes without cryptographic signatures.
Temporary mitigations suggest treating hash-only validation as an indicator of tampering rather than proof of immutability. Therefore, inspecting confirmation packages for the absence of cryptographic signatures or the presence of only hash validation can help detect vulnerable instances.
No specific commands are provided in the available resources. However, you can check the version of Striae installed to determine if it is prior to v3.0.0, which is vulnerable.
- Check Striae version: `striae --version` or equivalent command to verify if the version is below 3.0.0.
- Inspect confirmation packages for signature metadata; absence of signatures indicates vulnerability.
- Review logs or audit exports for hash-only validation events, which may indicate vulnerable workflows.
What immediate steps should I take to mitigate this vulnerability?
The primary and recommended mitigation is to upgrade Striae to version 3.0.0 or later, which fixes the vulnerability by enforcing cryptographically signed forensic manifests and fail-closed verification.
If immediate upgrade is not possible, temporary mitigations include:
- Treat hash-only validation as an indicator of tampering rather than proof of immutability.
- Restrict package exchange to trusted, authenticated internal channels to reduce risk of tampered packages.
- Require out-of-band reviewer attestation for sensitive confirmation workflows to add manual verification.
- Pause imports from untrusted sources until the system is upgraded to a secure version.