---
id: CVE-2026-8367
title: aria2c accepts a server certificate with incorrect Extended Key Usage (EKU)
summary: >-
  aria2c accepts a server certificate with incorrect Extended Key Usage (EKU).
  If the attackers compromise a certificate (with the associated private key)
  issued for a different purpose, they may be able to reuse it for TLS server
  authenti…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-295
vendor: aria2_project
product: aria2
affected:
  - aria2 < 1.37.0
patched:
  - aria2 1.37.0
published: '2026-05-13'
updated: '2026-08-19'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8367'
references:
  - url: 'https://www.tenable.com/security/research/tra-2026-38'
    label: vulnreport@tenable.com
tags:
  - nvd
epss: 0.00127
epssPercentile: 0.0272
ingestedAt: '2026-08-19T13:39:33.737Z'
---

## Overview

aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.

## Affected

- `aria2 < 1.37.0`

## Remediation

Upgrade past the affected range:

- `aria2 1.37.0`