« Volver al listado

CVE-2026-26275

Estado: AnalizadaAlta (7.5)—

httpsig-hyper is a hyper extension for http message signatures. An issue was discovered in `httpsig-hyper` prior to version 0.0.23 where Digest header verification could incorrectly succeed due to misuse of Rust's `matches!` macro. Specifically, the comparison `if matches!(digest, _expected_digest)` treated `_expected_digest` as a pattern binding rather than a value comparison, resulting in unconditional success of the match expression. As a consequence, digest verification could incorrectly return success even when the computed digest did not match the expected value.

Leer descripción completaMostrar menos

Applications relying on Digest verification as part of HTTP message signature validation may therefore fail to detect message body modification. The severity depends on how the library is integrated and whether additional signature validation layers are enforced. This issue has been fixed in `httpsig-hyper` 0.0.23. The fix replaces the incorrect `matches!` usage with proper value comparison and additionally introduces constant-time comparison for digest verification as defense-in-depth. Regression tests have also been added to prevent reintroduction of this issue. Users are strongly advised to upgrade to the patched version. There is no reliable workaround without upgrading. Users who cannot immediately upgrade should avoid relying solely on Digest verification for message integrity and ensure that full HTTP message signature verification is enforced at the application layer.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network TrafficApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Junkurihara — Httpsig-hyper

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-26275",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-26275",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-20T15:32:12.586184Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "junkurihara",
          "product": "httpsig-rs",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.0.23"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-19T22:16:46.493",
  "references": [
    {
      "url": "https://github.com/junkurihara/httpsig-rs/commit/5533f596c650377e02f4aa9e3eb8dba591b87370",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/junkurihara/httpsig-rs/commit/65cbd19b395180a4bba09a89746c4b14ccb8d297",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/junkurihara/httpsig-rs/pull/14",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/junkurihara/httpsig-rs/pull/15",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/junkurihara/httpsig-rs/security/advisories/GHSA-7v42-g35v-xrch",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-354"
        },
        {
          "lang": "en",
          "value": "CWE-697"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "httpsig-hyper is a hyper extension for http message signatures. An issue was discovered in `httpsig-hyper` prior to version 0.0.23 where Digest header verification could incorrectly succeed due to misuse of Rust's `matches!` macro. Specifically, the comparison `if matches!(digest, _expected_digest)` treated `_expected_digest` as a pattern binding rather than a value comparison, resulting in unconditional success of the match expression. As a consequence, digest verification could incorrectly return success even when the computed digest did not match the expected value. Applications relying on Digest verification as part of HTTP message signature validation may therefore fail to detect message body modification. The severity depends on how the library is integrated and whether additional signature validation layers are enforced. This issue has been fixed in `httpsig-hyper` 0.0.23. The fix replaces the incorrect `matches!` usage with proper value comparison and additionally introduces constant-time comparison for digest verification as defense-in-depth. Regression tests have also been added to prevent reintroduction of this issue. Users are strongly advised to upgrade to the patched version. There is no reliable workaround without upgrading. Users who cannot immediately upgrade should avoid relying solely on Digest verification for message integrity and ensure that full HTTP message signature verification is enforced at the application layer."
    },
    {
      "lang": "es",
      "value": "httpsig-hyper es una extensión hyper para firmas de mensajes HTTP. Se descubrió un problema en 'httpsig-hyper' anterior a la versión 0.0.23 donde la verificación del encabezado Digest podría ser exitosa, aunque de forma indebida, por el mal funcionamiento de la macro 'matches!' de Rust. Específicamente, la comparación 'if matches!(digest, _expected_digest)' trataba '_expected_digest' como una vinculación de patrón en lugar de una comparación de valor, lo que resultaba en el éxito incondicional de la expresión de coincidencia. Como consecuencia, la verificación del digest podía devolver éxito incorrectamente incluso cuando el digest calculado no coincidía con el valor esperado. Por lo tanto, las aplicaciones que dependen de la verificación de Digest como parte de la validación de firmas de mensajes HTTP, pueden no detectar la modificación del cuerpo del mensaje. La gravedad depende de cómo se integra la biblioteca y si se aplican capas adicionales de validación de firmas. Este problema ha sido solucionado en 'httpsig-hyper' 0.0.23. La solución reemplaza el uso incorrecto de 'matches!' por una comparación de valor adecuada y adicionalmente introduce una comparación de tiempo constante para la verificación del digest como defensa en profundidad. También se han añadido pruebas de regresión para evitar la reintroducción de este problema. Se recomienda encarecidamente a los usuarios que actualicen a la versión parcheada. No hay una solución alternativa fiable sin actualizar. Los usuarios que no puedan actualizar inmediatamente deben evitar depender únicamente de la verificación de Digest para la integridad del mensaje y asegurarse de que la verificación completa de la firma de mensajes HTTP se aplique en la capa de aplicación."
    }
  ],
  "lastModified": "2026-06-17T10:26:01.703",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:junkurihara:httpsig-hyper:*:*:*:*:*:rust:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D02B03A-2C49-46ED-A5C0-EF91104582CA",
              "versionEndExcluding": "0.0.23"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}