rpm package
opensuse/mihomo&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/mihomo&distro=openSUSE%20Tumbleweed
Vulnerabilities (2)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-56862 | Hig | 7.5 | < 1.19.30-1.1 | 1.19.30-1.1 | Aug 13, 2026 | Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indef | |
| CVE-2026-42505 | Med | 5.3 | < 1.19.28-1.1 | 1.19.28-1.1 | Jul 8, 2026 | Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. |
- affected < 1.19.30-1.1fixed 1.19.30-1.1
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indef
- affected < 1.19.28-1.1fixed 1.19.28-1.1
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.