What’s Vulnerable › Vulnerabilities

CVE-2026-11751

• Severity: critical (CVSS 9.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-19 · updated 2026-10-22

Description

A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections.

Affected products

• LY Corporation Armeria: all versions — fixed in 1.41.0

How to fix

Upgrade to a fixed version: LY Corporation Armeria 1.41.0. Check the vendor advisory for mitigations.

References

• https://github.com/line/armeria/security/advisories/GHSA-6qfw-3mvj-m6v5
• https://line.github.io/security-advisory-blog/CVE-2026-11751/

Get alerted when CVE-2026-11751 or the next vulnerability affects your stack