Every CVESearch/Get API key

GHSA-gcfg-hmwx-wq5h

Httpful is Missing Certificate Validation

6.9 MediumFix available

GHSA-gcfg-hmwx-wq5h is a medium vulnerability (CVSS 6.9) in nategood/httpful, published September 9, 2024. No source lists public exploit code. Fixed in nategood/httpful 1.0.0.

What does this mean?
Severity
6.9 MediumCVSS 4.0, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.0.0nategood/httpful +2 more

Description

Httpful has Insecure HTTPS Connections due to Missing Default Certificate Validation

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Affected packages

Affected packages
PackageAffectedFixed
nategood/httpful
Packagist
before 1.0.0
1.0.0
nategood/httpful
TuxCare:Packagist
0.3.2 up to 0.3.2-p1+tuxcare
0.3.2-p1+tuxcare
nategood/httpful
Packagist
before 1.0.0, plus listed versions
0.1.00.1.20.1.40.1.50.1.6
Show 19 moreShow less
0.1.70.2.00.2.10.2.100.2.110.2.130.2.160.2.170.2.190.2.20.2.200.2.30.2.50.2.60.2.70.2.80.2.90.3.00.3.2
1.0.0

What each source reports

GitHub Advisories Score used6.9

Httpful is Missing Certificate Validation

Httpful has Insecure HTTPS Connections due to Missing Default Certificate Validation

Record
GHSA-gcfg-hmwx-wq5h
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
OSV6.9

Httpful is Missing Certificate Validation

Httpful has Insecure HTTPS Connections due to Missing Default Certificate Validation

Record
GHSA-gcfg-hmwx-wq5h
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
OSVCLSA-2026-1778460296No score

TuxCare security update for nategood/httpful (1 CVE)

TuxCare rebuilt nategood/httpful to address 1 CVE. Fixed in 0.3.2-p1+tuxcare.

Record
CLSA-2026-1778460296
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open