CWE-297— Improper Validation of Certificate with Host Mismatch
The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.— MITRE CWE catalog
111 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-297page 3 of 3
- CVE-2024-54019MEDIUMCVSS 4.8EG 4.82025-06-10
A improper validation of certificate with host mismatch in Fortinet FortiClientWindows version 7.4.0, versions 7.2.0 through 7.2.6, and 7.0 all versions allow an unauthorized attacker to redirect VPN connections via DNS spoofing or another…
- CVE-2020-26234MEDIUMCVSS 4.8EG 4.82020-12-08
Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented cer…
- CVE-2025-4295MEDIUMCVSS 4.6EG 4.62025-07-22
Improper Validation of Certificate with Host Mismatch vulnerability in HotelRunner B2B allows HTTP Response Splitting. This issue affects B2B: before 04.06.2025.
- CVE-2022-29082MEDIUMCVSS 3.7EG 4.62022-05-26
Dell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0.x, 19.4.x, 19.4.0.x, 19.5.x,19.5.0.x, 19.6 and 19.6.0.1 and 19.6.0.2 contain an Improper Validation of Certificate with Host Mismatch vulnera…
- CVE-2026-91769MEDIUMCVSS 4.3EG 4.32026-09-25
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service id…
- CVE-2025-42921MEDIUMCVSS 4.2EG 4.22025-04-17
In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin
- CVE-2018-19946MEDIUMCVSS 4.2EG 4.22020-09-11
The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerability could allow an attacker to spoof a trusted entity by interfering in the communication path betwee…
- CVE-2014-3522MEDIUMCVSS v2 4.0EG 4.02014-08-19
The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle at…
- CVE-2026-12730LOWCVSS 3.8EG 3.82026-08-05
IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow fails to properly …
- CVE-2025-46551LOWCVSS 3.7EG 3.72025-05-07
JRuby-OpenSSL is an add-on gem for JRuby that emulates the Ruby OpenSSL native library. Starting in JRuby-OpenSSL version 0.12.1 and prior to version 0.15.4 (corresponding to JRuby versions starting in 9.3.4.0 prior to 9.4.12.1 and 10.0.0.…
- CVE-2026-87758UnratedEG not assessed2026-11-10
The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read o…
Map vulnerabilities like CWE-297 to your infrastructure
EchelonGraph correlates every CVE — across CWE-297 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →