CVE-2026-26275

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26275", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-12T17:10:53.413Z", "datePublished": "2026-02-19T21:25:37.335Z", "dateUpdated": "2026-02-20T15:42:05.498Z"}, "containers": {"cna": {"title": "httpsig-hyper has Improper Digest Verification that May Allow Message Integrity Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-354", "lang": "en", "description": "CWE-354: Improper Validation of Integrity Check Value", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-697", "lang": "en", "description": "CWE-697: Incorrect Comparison", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/junkurihara/httpsig-rs/security/advisories/GHSA-7v42-g35v-xrch", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/junkurihara/httpsig-rs/security/advisories/GHSA-7v42-g35v-xrch"}, {"name": "https://github.com/junkurihara/httpsig-rs/pull/14", "tags": ["x_refsource_MISC"], "url": "https://github.com/junkurihara/httpsig-rs/pull/14"}, {"name": "https://github.com/junkurihara/httpsig-rs/pull/15", "tags": ["x_refsource_MISC"], "url": "https://github.com/junkurihara/httpsig-rs/pull/15"}, {"name": "https://github.com/junkurihara/httpsig-rs/commit/5533f596c650377e02f4aa9e3eb8dba591b87370", "tags": ["x_refsource_MISC"], "url": "https://github.com/junkurihara/httpsig-rs/commit/5533f596c650377e02f4aa9e3eb8dba591b87370"}, {"name": "https://github.com/junkurihara/httpsig-rs/commit/65cbd19b395180a4bba09a89746c4b14ccb8d297", "tags": ["x_refsource_MISC"], "url": "https://github.com/junkurihara/httpsig-rs/commit/65cbd19b395180a4bba09a89746c4b14ccb8d297"}], "affected": [{"vendor": "junkurihara", "product": "httpsig-rs", "versions": [{"version": "< 0.0.23", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-19T21:25:37.335Z"}, "descriptions": [{"lang": "en", "value": "httpsig-hyper is a hyper extension for http message signatures. An issue was discovered in `httpsig-hyper` prior to version 0.0.23 where Digest header verification could incorrectly succeed due to misuse of Rust's `matches!` macro. Specifically, the comparison `if matches!(digest, _expected_digest)` treated `_expected_digest` as a pattern binding rather than a value comparison, resulting in unconditional success of the match expression. As a consequence, digest verification could incorrectly return success even when the computed digest did not match the expected value. Applications relying on Digest verification as part of HTTP message signature validation may therefore fail to detect message body modification. The severity depends on how the library is integrated and whether additional signature validation layers are enforced. This issue has been fixed in `httpsig-hyper` 0.0.23. The fix replaces the incorrect `matches!` usage with proper value comparison and additionally introduces constant-time comparison for digest verification as defense-in-depth. Regression tests have also been added to prevent reintroduction of this issue. Users are strongly advised to upgrade to the patched version. There is no reliable workaround without upgrading. Users who cannot immediately upgrade should avoid relying solely on Digest verification for message integrity and ensure that full HTTP message signature verification is enforced at the application layer."}], "source": {"advisory": "GHSA-7v42-g35v-xrch", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T15:32:12.586184Z", "id": "CVE-2026-26275", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:42:05.498Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26275", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T15:32:12.586184Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:32:14.371Z"}}], "cna": {"title": "httpsig-hyper has Improper Digest Verification that May Allow Message Integrity Bypass", "source": {"advisory": "GHSA-7v42-g35v-xrch", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "junkurihara", "product": "httpsig-rs", "versions": [{"status": "affected", "version": "< 0.0.23"}]}], "references": [{"url": "https://github.com/junkurihara/httpsig-rs/security/advisories/GHSA-7v42-g35v-xrch", "name": "https://github.com/junkurihara/httpsig-rs/security/advisories/GHSA-7v42-g35v-xrch", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/junkurihara/httpsig-rs/pull/14", "name": "https://github.com/junkurihara/httpsig-rs/pull/14", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/junkurihara/httpsig-rs/pull/15", "name": "https://github.com/junkurihara/httpsig-rs/pull/15", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/junkurihara/httpsig-rs/commit/5533f596c650377e02f4aa9e3eb8dba591b87370", "name": "https://github.com/junkurihara/httpsig-rs/commit/5533f596c650377e02f4aa9e3eb8dba591b87370", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/junkurihara/httpsig-rs/commit/65cbd19b395180a4bba09a89746c4b14ccb8d297", "name": "https://github.com/junkurihara/httpsig-rs/commit/65cbd19b395180a4bba09a89746c4b14ccb8d297", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "httpsig-hyper is a hyper extension for http message signatures. An issue was discovered in `httpsig-hyper` prior to version 0.0.23 where Digest header verification could incorrectly succeed due to misuse of Rust's `matches!` macro. Specifically, the comparison `if matches!(digest, _expected_digest)` treated `_expected_digest` as a pattern binding rather than a value comparison, resulting in unconditional success of the match expression. As a consequence, digest verification could incorrectly return success even when the computed digest did not match the expected value. Applications relying on Digest verification as part of HTTP message signature validation may therefore fail to detect message body modification. The severity depends on how the library is integrated and whether additional signature validation layers are enforced. This issue has been fixed in `httpsig-hyper` 0.0.23. The fix replaces the incorrect `matches!` usage with proper value comparison and additionally introduces constant-time comparison for digest verification as defense-in-depth. Regression tests have also been added to prevent reintroduction of this issue. Users are strongly advised to upgrade to the patched version. There is no reliable workaround without upgrading. Users who cannot immediately upgrade should avoid relying solely on Digest verification for message integrity and ensure that full HTTP message signature verification is enforced at the application layer."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-354", "description": "CWE-354: Improper Validation of Integrity Check Value"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-697", "description": "CWE-697: Incorrect Comparison"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-19T21:25:37.335Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26275", "state": "PUBLISHED", "dateUpdated": "2026-02-20T15:42:05.498Z", "dateReserved": "2026-02-12T17:10:53.413Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-19T21:25:37.335Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "httpsig-rs", "vendor": "junkurihara", "versions": [{"status": "affected", "version": "< 0.0.23"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:junkurihara:httpsig-hyper:*:*:*:*:*:rust:*:*", "matchCriteriaId": "8D02B03A-2C49-46ED-A5C0-EF91104582CA", "versionEndExcluding": "0.0.23", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "httpsig-hyper is a hyper extension for http message signatures. An issue was discovered in `httpsig-hyper` prior to version 0.0.23 where Digest header verification could incorrectly succeed due to misuse of Rust's `matches!` macro. Specifically, the comparison `if matches!(digest, _expected_digest)` treated `_expected_digest` as a pattern binding rather than a value comparison, resulting in unconditional success of the match expression. As a consequence, digest verification could incorrectly return success even when the computed digest did not match the expected value. Applications relying on Digest verification as part of HTTP message signature validation may therefore fail to detect message body modification. The severity depends on how the library is integrated and whether additional signature validation layers are enforced. This issue has been fixed in `httpsig-hyper` 0.0.23. The fix replaces the incorrect `matches!` usage with proper value comparison and additionally introduces constant-time comparison for digest verification as defense-in-depth. Regression tests have also been added to prevent reintroduction of this issue. Users are strongly advised to upgrade to the patched version. There is no reliable workaround without upgrading. Users who cannot immediately upgrade should avoid relying solely on Digest verification for message integrity and ensure that full HTTP message signature verification is enforced at the application layer."}, {"lang": "es", "value": "httpsig-hyper es una extensi\u00f3n hyper para firmas de mensajes HTTP. Se descubri\u00f3 un problema en 'httpsig-hyper' anterior a la versi\u00f3n 0.0.23 donde la verificaci\u00f3n del encabezado Digest podr\u00eda ser exitosa, aunque de forma indebida, por el mal funcionamiento de la macro 'matches!' de Rust. Espec\u00edficamente, la comparaci\u00f3n 'if matches!(digest, _expected_digest)' trataba '_expected_digest' como una vinculaci\u00f3n de patr\u00f3n en lugar de una comparaci\u00f3n de valor, lo que resultaba en el \u00e9xito incondicional de la expresi\u00f3n de coincidencia. Como consecuencia, la verificaci\u00f3n del digest pod\u00eda devolver \u00e9xito incorrectamente incluso cuando el digest calculado no coincid\u00eda con el valor esperado. Por lo tanto, las aplicaciones que dependen de la verificaci\u00f3n de Digest como parte de la validaci\u00f3n de firmas de mensajes HTTP, pueden no detectar la modificaci\u00f3n del cuerpo del mensaje. La gravedad depende de c\u00f3mo se integra la biblioteca y si se aplican capas adicionales de validaci\u00f3n de firmas. Este problema ha sido solucionado en 'httpsig-hyper' 0.0.23. La soluci\u00f3n reemplaza el uso incorrecto de 'matches!' por una comparaci\u00f3n de valor adecuada y adicionalmente introduce una comparaci\u00f3n de tiempo constante para la verificaci\u00f3n del digest como defensa en profundidad. Tambi\u00e9n se han a\u00f1adido pruebas de regresi\u00f3n para evitar la reintroducci\u00f3n de este problema. Se recomienda encarecidamente a los usuarios que actualicen a la versi\u00f3n parcheada. No hay una soluci\u00f3n alternativa fiable sin actualizar. Los usuarios que no puedan actualizar inmediatamente deben evitar depender \u00fanicamente de la verificaci\u00f3n de Digest para la integridad del mensaje y asegurarse de que la verificaci\u00f3n completa de la firma de mensajes HTTP se aplique en la capa de aplicaci\u00f3n."}], "id": "CVE-2026-26275", "lastModified": "2026-06-17T10:26:01.703", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26275", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T15:32:12.586184Z", "version": "2.0.3"}}]}, "published": "2026-02-19T22:16:46.493", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/junkurihara/httpsig-rs/commit/5533f596c650377e02f4aa9e3eb8dba591b87370"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/junkurihara/httpsig-rs/commit/65cbd19b395180a4bba09a89746c4b14ccb8d297"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/junkurihara/httpsig-rs/pull/14"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/junkurihara/httpsig-rs/pull/15"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/junkurihara/httpsig-rs/security/advisories/GHSA-7v42-g35v-xrch"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-354"}, {"lang": "en", "value": "CWE-697"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.0.23)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "httpsig-rs", "source": "cna", "vendor": "junkurihara"}, "product": "httpsig-rs", "vendor": "junkurihara"}], "analysis": {"en": {"generated_at": "2026-04-17T17:51:59.941802+00:00", "value": {"mitigation_remediation": ["Upgrade the httpsig\u2011hyper library to version\u00a00.0.23\u00a0or later, which replaces the incorrect\u00a0matches!\u00a0usage with proper value comparison and adds a constant\u2011time digest check.", "If an upgrade cannot be performed immediately, ensure that full HTTP message signature verification is enforced at the application level and do not rely solely on the Digest header to guarantee message integrity.", "Implement regression tests that verify digest calculations and comparisons to guard against future regressions in this logic."], "summary": {"action": "Immediate Patch", "impact": "Message integrity bypass due to incorrect digest verification"}, "threat_synthesis": {"affected_systems": "Affected versions are all releases of\u00a0httpsig-hyper\u00a0prior to 0.0.23, which is distributed by the Rust crate\u00a0httpsig\u2011rs\u00a0from the vendor\u00a0junkurihara. Any application that incorporates this hyper extension for HTTP message signatures without applying additional integrity checks is vulnerable. The issue applies to HTTP traffic handled via Hyper and any client or server code that relies solely on the Digest header verification provided by this library.", "description_and_impact": "This vulnerability arises from the misuse of Rust\u2019s\u00a0matches!\u00a0macro in the\u00a0httpsig-hyper\u00a0library, where the digest comparison was written as\u202fif\u00a0matches!(digest, _expected_digest). The macro interprets the right\u2011hand side as a pattern binding rather than a value, causing the condition to succeed unconditionally. Consequently, the library reports successful digest verification even when the computed digest does not match the expected value, allowing an attacker to modify the HTTP message body without detection. The weakness relates to improper authentication logic and signature parsing, identified as CWE\u2011354 and CWE\u2011697.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1\u202f% suggests a low likelihood of active exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, meaning no known public exploits have been reported. The attack vector is inferred to be remote, as an attacker can craft HTTP requests or responses during transit to trigger the digest bypass. The impact of exploitation would be the undetected alteration of message content, potentially leading to unauthorized actions or data tampering. However, because the vulnerability remains unpatched in older versions, remediation remains a high priority."}}}}, "created": "2026-02-20T09:53:52.640669+00:00", "updated": "2026-04-17T18:00:12.174865+00:00", "vendors": ["junkurihara", "junkurihara$PRODUCT$httpsig-rs"]}