CVE-2026-109144
Received Received - Intake

Resource Exhaustion in certvalidator Certificate Path Builder

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A vulnerability was identified in wbond certvalidator up to 0.11.1. This issue affects some unknown processing of the component Certificate Path Builder. Such manipulation leads to resource consumption. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109144
EUVD
EUVD-2026-98376

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wbond certvalidator 0.11.0
wbond certvalidator 0.11.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service issue in the wbond certvalidator library up to version 0.11.1. It occurs during certificate path building where an attacker can manipulate inputs to cause excessive resource consumption. The attack is remote and does not require authentication.

Detection Guidance

This vulnerability is specific to the certvalidator library and may not have direct network detection commands. Monitor for unusual resource consumption during certificate validation processes. Check application logs for excessive CPU or memory usage when processing certificates.

Impact Analysis

If exploited, this vulnerability could cause the certvalidator service to consume excessive CPU or memory, leading to degraded performance or crashes. This may disrupt applications relying on certificate validation, such as web servers or APIs.

Compliance Impact

The vulnerability causes resource consumption through denial-of-service in certificate path validation, which could disrupt systems handling sensitive data. This may impact compliance by degrading availability of systems subject to GDPR or HIPAA, where continuous access to personal or health data is required. However, the specific compliance impact depends on system implementation and mitigation measures.

Mitigation Strategies

Upgrade certvalidator to the latest version if available. If no patch exists, consider disabling certificate validation temporarily or switching to an alternative library. Monitor vendor updates for security fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109144. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart