This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-109399 →

DEBIAN-CVE-2026-109399

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.5...

Original description

The description as published by the source.

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can embed that intermediate in the signature to install malicious updates.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 swupdate

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 swupdate

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.05+dfsg-1"}]}]

References

advisory security-tracker.debian.org