CVE-2026-11751

A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections.

Score

CVSS 4.0 9.1 Critical

Status

Deferred - dl_cve@linecorp.com

Published

2026-08-19

Last modified

2026-10-22

Affected products

• Armeria (Ly Corporation)

References

• https://line.github.io/security-advisory-blog/CVE-2026-11751/
• https://github.com/line/armeria/security/advisories/GHSA-6qfw-3mvj-m6v5