Read the docs
TI-2009-02881 Aliases CVE-2009-3024GHSA-5v53-7q2j-vjr2

The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL…

Priority LOW 22CWE-310Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate.

Why it matters now

EPSS 0.00996 62nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.14:*:*:*:*:*:*:*1.14VulnerableIo-socket-ssl
cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.15:*:*:*:*:*:*:*1.15VulnerableIo-socket-ssl
cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.16:*:*:*:*:*:*:*1.16VulnerableIo-socket-ssl
cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.16_1:*:*:*:*:*:*:*1.16_1VulnerableIo-socket-ssl
cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.16_2:*:*:*:*:*:*:*1.16_2VulnerableIo-socket-ssl
cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.16_3:*:*:*:*:*:*:*1.16_3VulnerableIo-socket-ssl
cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.17:*:*:*:*:*:*:*1.17VulnerableIo-socket-ssl
cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.18:*:*:*:*:*:*:*1.18VulnerableIo-socket-ssl
cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.19:*:*:*:*:*:*:*1.19VulnerableIo-socket-ssl
cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.20:*:*:*:*:*:*:*1.20VulnerableIo-socket-ssl
  • cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.14:*:*:*:*:*:*:* Versions 1.14 Vulnerable ·Io-socket-ssl
  • cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.15:*:*:*:*:*:*:* Versions 1.15 Vulnerable ·Io-socket-ssl
  • cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.16:*:*:*:*:*:*:* Versions 1.16 Vulnerable ·Io-socket-ssl
  • cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.16_1:*:*:*:*:*:*:* Versions 1.16_1 Vulnerable ·Io-socket-ssl
  • cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.16_2:*:*:*:*:*:*:* Versions 1.16_2 Vulnerable ·Io-socket-ssl
  • cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.16_3:*:*:*:*:*:*:* Versions 1.16_3 Vulnerable ·Io-socket-ssl
  • cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.17:*:*:*:*:*:*:* Versions 1.17 Vulnerable ·Io-socket-ssl
  • cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.18:*:*:*:*:*:*:* Versions 1.18 Vulnerable ·Io-socket-ssl
  • cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.19:*:*:*:*:*:*:* Versions 1.19 Vulnerable ·Io-socket-ssl
  • cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.20:*:*:*:*:*:*:* Versions 1.20 Vulnerable ·Io-socket-ssl
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.21:*:*:*:*:*:*:*1.21VulnerableIo-socket-ssl
cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.22:*:*:*:*:*:*:*1.22VulnerableIo-socket-ssl
cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.23:*:*:*:*:*:*:*1.23VulnerableIo-socket-ssl
cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.24:*:*:*:*:*:*:*1.24VulnerableIo-socket-ssl
cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.25:*:*:*:*:*:*:*1.25VulnerableIo-socket-ssl
  • cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.21:*:*:*:*:*:*:* Versions 1.21 Vulnerable ·Io-socket-ssl
  • cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.22:*:*:*:*:*:*:* Versions 1.22 Vulnerable ·Io-socket-ssl
  • cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.23:*:*:*:*:*:*:* Versions 1.23 Vulnerable ·Io-socket-ssl
  • cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.24:*:*:*:*:*:*:* Versions 1.24 Vulnerable ·Io-socket-ssl
  • cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.25:*:*:*:*:*:*:* Versions 1.25 Vulnerable ·Io-socket-ssl

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-3024
  2. 2026-10-03 Alias added: GHSA-5v53-7q2j-vjr2

References

Advisory 2

Other 5

  • TI-2010-04067 The IO::Socket::SSL module 1.35 for Perl, when verify_mode is not VERIFY_NONE, fails open… CVSS 2.0MEDIUM 4.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences