JLSEC-2026-237

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-237.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-237.json

JSON Data

https://api.test.osv.dev/v1/vulns/JLSEC-2026-237

Upstream

CVE-2023-0466

EUVD-2023-12520

GHSA-pxvj-4wx4-gv6w

Published

2026-04-27T18:33:55.942Z

Modified

2026-07-25T18:24:44.612263517Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

The function `X509_VERIFY_PARAM_add0_policy()` is documented to implicitly enable the certificate...

Details

The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification.

As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function.

Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument.

Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.

Database specific

{
    "sources": [
        {
            "modified": "2026-06-17T05:25:37.007Z",
            "id": "CVE-2023-0466",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0466",
            "database_specific": {
                "status": "Modified"
            },
            "published": "2023-03-28T15:15:06.880Z",
            "imported": "2026-07-17T21:26:22.782Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-0466"
        },
        {
            "modified": "2025-02-19T18:33:19Z",
            "id": "GHSA-pxvj-4wx4-gv6w",
            "html_url": "https://github.com/advisories/GHSA-pxvj-4wx4-gv6w",
            "imported": "2026-07-17T21:26:22.963Z",
            "published": "2023-03-28T15:30:16Z",
            "url": "https://api.github.com/advisories/GHSA-pxvj-4wx4-gv6w"
        },
        {
            "modified": "2025-02-19T17:12:25Z",
            "id": "EUVD-2023-12520",
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12520",
            "imported": "2026-07-17T21:26:32.072Z",
            "published": "2023-03-28T14:30:49Z",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2023-12520"
        }
    ],
    "license": "CC-BY-4.0"
}

References

Affected packages

Julia / OpenSSL_jll

Package

Name: OpenSSL_jll
Purl: pkg:julia/OpenSSL_jll?uuid=458c3c95-2e84-50aa-8efc-19380b2a3a95

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.21+0

Introduced

3.0.8+0

Fixed

3.0.9+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-237.json"

Julia / Openresty_jll

Package

Name: Openresty_jll
Purl: pkg:julia/Openresty_jll?uuid=87da34d4-7b1b-5a94-8376-8cb65bf3132c

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.27.1+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-237.json"