Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-297
Weakness type CWE-297 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 46 | 42 | 0 |
Monthly trend
▂▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▂▁▁▂▁▁▂▁▂▁▂▃▆▅█▅
2025-11 0 · 2025-12 0 · 2026-01 1 · 2026-02 0 · 2026-03 1 · 2026-04 0 · 2026-05 2 · 2026-06 4 · 2026-07 8 · 2026-08 7 · 2026-09 12 · 2026-10 7
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2024-2466 | 6.5 | 73.0 | — | TLS certificate check bypass with mbedTLS |
| CVE-2026-43869 | 7.3 | 56.1 | — | Apache Thrift: TSSLTransportFactory.java hostname verification |
| CVE-2026-65942 | 7.5 | 47.1 | — | Apache Ranger: Clients accept TLS certificates issued for other hostnames |
| CVE-2025-15079 | 5.3 | 44.8 | — | libssh global known_hosts override |
| CVE-2026-54275 | 2.7 | 39.3 | — | AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections |
| CVE-2026-42790 | 7.6 | 39.2 | — | nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verif… |
| CVE-2025-3501 | 8.2 | 38.3 | — | Org.keycloak.protocol.services: keycloak hostname verification |
| CVE-2026-48145 | 8.2 | 34.6 | — | Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass |
| CVE-2026-19553 | 7.6 | 32.8 | — | SSLContext.wrap_bio() missing validation of server_hostname parameter |
| CVE-2026-48144 | 9.1 | 32.8 | — | Apache Thrift: c_glib TLS Client Missing Hostname Verification |
| CVE-2026-12064 | 7.5 | 32.6 | — | proto-default skips SSH verification |
| CVE-2026-92943 | 9.2 | 30.5 | — | Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python |
| CVE-2026-59638 | 9.3 | 26.5 | — | JSSE hostname verifier CN-fallback enabled by default despite documented opt-in |
| CVE-2026-84197 | 9.2 | 26.3 | — | — |
| CVE-2025-59060 | 5.3 | 25.4 | — | Apache Ranger: Hostname verification bypass in NiFiRegistryClient |
| CVE-2026-59969 | 7.5 | 24.5 | — | Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode |
| CVE-2026-9547 | 7.4 | 24.0 | — | SSH improper host validation |
| CVE-2026-66053 | 5.9 | 20.4 | — | Apache Thrift: Python TSSLSocket Hostname Matcher Import |
| CVE-2026-63374 | 9.3 | 20.1 | — | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing |
| CVE-2026-15925 | 9.2 | 19.9 | — | Improper TLS Hostname Verification in Snowflake Connector for Python |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| apache | 10 |
| curl | 4 |
| dell | 2 |
| fortinet | 2 |
| ibm | 2 |
| agronholm | 1 |
| aio-libs | 1 |
| apereo | 1 |
| aws | 1 |
| benoitc | 1 |
| devolutions | 1 |
| eclipse foundation | 1 |
| erlang | 1 |
| ffmpeg | 1 |
| hotelrunner | 1 |
