CVE-2026-40097: Step CA affected by an index out of bounds panic in TPM attestation EKU validation
An attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key (AK) certificate with an empty Extended Key Usage (EKU) extension during TPM device attestation.
References
- github.com/advisories/GHSA-9qq8-cgcv-qmc9
- github.com/smallstep/certificates
- github.com/smallstep/certificates/commit/ffd31ac0a87e03b0224cb8363094bfe602242888
- github.com/smallstep/certificates/pull/2569
- github.com/smallstep/certificates/releases/tag/v0.30.0
- github.com/smallstep/certificates/security/advisories/GHSA-9qq8-cgcv-qmc9
- nvd.nist.gov/vuln/detail/CVE-2026-40097
Code Behaviors & Features
Detect and mitigate CVE-2026-40097 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →