Read the docs
TI-2020-16084 Aliases CVE-2020-26263GHSA-wvcv-832q-fjg7

RSA vulnerability in tslite-ng

Priority LOW 36CWE-326Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-326.

Summary

tlslite-ng is an open source python library that implements SSL and TLS cryptographic protocols. In tlslite-ng before versions 0.7.6 and 0.8.0-alpha39, the code that performs decryption and padding check in RSA PKCS#1 v1.5 decryption is data dependant. In particular, the code has multiple ways in which it leaks information about the decrypted ciphertext. It aborts as soon as the plaintext doesn't start with 0x00, 0x02. All TLS servers that enable RSA key exchange as well as applications that use the RSA decryption API directly are vulnerable. This is patched in versions 0.7.6 and 0.8.0-alpha39. Note: the patches depend on Python processing the individual bytes in side-channel free manner, this is known to not the case (see reference). As such, users that require side-channel resistance are recommended to use different TLS implementations, as stated in the security policy of tlslite-ng.

Why it matters now

EPSS 0.01523 74th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed tlslite-ng (tlsfuzzer): 0.7.6, 0.8.0-alpha39tlslite-ng (PyPI): 0.7.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
tlsfuzzertlslite-ngbefore 0.7.6; 0.8.0-alpha1 to before 0.8.0-alpha390.7.6, 0.8.0-alpha39Patch availableCNA
—tlslite-ng (PyPI)before 0.7.60.7.6Patch availableGHSA-wvcv-832q-fjg7
  • tlslite-ng Vendortlsfuzzer Affected before 0.7.6; 0.8.0-alpha1 to before 0.8.0-alpha39 Fixed in 0.7.6, 0.8.0-alpha39 Patch available CNA
  • tlslite-ng (PyPI) Vendor— Affected before 0.7.6 Fixed in 0.7.6 Patch available GHSA-wvcv-832q-fjg7

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:a:tlslite-ng_project:tlslite-ng:*:*:*:*:*:*:*:*before 0.7.6VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha1:*:*:*:*:*:*0.8.0 alpha1VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha10:*:*:*:*:*:*0.8.0 alpha10VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha11:*:*:*:*:*:*0.8.0 alpha11VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha12:*:*:*:*:*:*0.8.0 alpha12VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha13:*:*:*:*:*:*0.8.0 alpha13VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha14:*:*:*:*:*:*0.8.0 alpha14VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha15:*:*:*:*:*:*0.8.0 alpha15VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha16:*:*:*:*:*:*0.8.0 alpha16VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha17:*:*:*:*:*:*0.8.0 alpha17VulnerableTlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:*:*:*:*:*:*:*:* Versions before 0.7.6 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha1:*:*:*:*:*:* Versions 0.8.0 alpha1 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha10:*:*:*:*:*:* Versions 0.8.0 alpha10 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha11:*:*:*:*:*:* Versions 0.8.0 alpha11 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha12:*:*:*:*:*:* Versions 0.8.0 alpha12 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha13:*:*:*:*:*:* Versions 0.8.0 alpha13 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha14:*:*:*:*:*:* Versions 0.8.0 alpha14 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha15:*:*:*:*:*:* Versions 0.8.0 alpha15 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha16:*:*:*:*:*:* Versions 0.8.0 alpha16 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha17:*:*:*:*:*:* Versions 0.8.0 alpha17 Vulnerable ·Tlslite-ng Project
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha18:*:*:*:*:*:*0.8.0 alpha18VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha19:*:*:*:*:*:*0.8.0 alpha19VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha2:*:*:*:*:*:*0.8.0 alpha2VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha20:*:*:*:*:*:*0.8.0 alpha20VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha21:*:*:*:*:*:*0.8.0 alpha21VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha22:*:*:*:*:*:*0.8.0 alpha22VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha23:*:*:*:*:*:*0.8.0 alpha23VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha24:*:*:*:*:*:*0.8.0 alpha24VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha25:*:*:*:*:*:*0.8.0 alpha25VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha26:*:*:*:*:*:*0.8.0 alpha26VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha27:*:*:*:*:*:*0.8.0 alpha27VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha28:*:*:*:*:*:*0.8.0 alpha28VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha29:*:*:*:*:*:*0.8.0 alpha29VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha3:*:*:*:*:*:*0.8.0 alpha3VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha30:*:*:*:*:*:*0.8.0 alpha30VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha31:*:*:*:*:*:*0.8.0 alpha31VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha32:*:*:*:*:*:*0.8.0 alpha32VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha33:*:*:*:*:*:*0.8.0 alpha33VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha34:*:*:*:*:*:*0.8.0 alpha34VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha35:*:*:*:*:*:*0.8.0 alpha35VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha36:*:*:*:*:*:*0.8.0 alpha36VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha37:*:*:*:*:*:*0.8.0 alpha37VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha38:*:*:*:*:*:*0.8.0 alpha38VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha4:*:*:*:*:*:*0.8.0 alpha4VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha5:*:*:*:*:*:*0.8.0 alpha5VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha6:*:*:*:*:*:*0.8.0 alpha6VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha7:*:*:*:*:*:*0.8.0 alpha7VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha8:*:*:*:*:*:*0.8.0 alpha8VulnerableTlslite-ng Project
cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha9:*:*:*:*:*:*0.8.0 alpha9VulnerableTlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha18:*:*:*:*:*:* Versions 0.8.0 alpha18 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha19:*:*:*:*:*:* Versions 0.8.0 alpha19 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha2:*:*:*:*:*:* Versions 0.8.0 alpha2 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha20:*:*:*:*:*:* Versions 0.8.0 alpha20 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha21:*:*:*:*:*:* Versions 0.8.0 alpha21 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha22:*:*:*:*:*:* Versions 0.8.0 alpha22 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha23:*:*:*:*:*:* Versions 0.8.0 alpha23 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha24:*:*:*:*:*:* Versions 0.8.0 alpha24 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha25:*:*:*:*:*:* Versions 0.8.0 alpha25 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha26:*:*:*:*:*:* Versions 0.8.0 alpha26 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha27:*:*:*:*:*:* Versions 0.8.0 alpha27 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha28:*:*:*:*:*:* Versions 0.8.0 alpha28 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha29:*:*:*:*:*:* Versions 0.8.0 alpha29 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha3:*:*:*:*:*:* Versions 0.8.0 alpha3 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha30:*:*:*:*:*:* Versions 0.8.0 alpha30 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha31:*:*:*:*:*:* Versions 0.8.0 alpha31 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha32:*:*:*:*:*:* Versions 0.8.0 alpha32 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha33:*:*:*:*:*:* Versions 0.8.0 alpha33 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha34:*:*:*:*:*:* Versions 0.8.0 alpha34 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha35:*:*:*:*:*:* Versions 0.8.0 alpha35 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha36:*:*:*:*:*:* Versions 0.8.0 alpha36 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha37:*:*:*:*:*:* Versions 0.8.0 alpha37 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha38:*:*:*:*:*:* Versions 0.8.0 alpha38 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha4:*:*:*:*:*:* Versions 0.8.0 alpha4 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha5:*:*:*:*:*:* Versions 0.8.0 alpha5 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha6:*:*:*:*:*:* Versions 0.8.0 alpha6 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha7:*:*:*:*:*:* Versions 0.8.0 alpha7 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha8:*:*:*:*:*:* Versions 0.8.0 alpha8 Vulnerable ·Tlslite-ng Project
  • cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha9:*:*:*:*:*:* Versions 0.8.0 alpha9 Vulnerable ·Tlslite-ng Project

Remediation

  • Fix · CNA tlslite-ng (tlsfuzzer) Fixed in 0.7.6, 0.8.0-alpha39
  • Fix · GHSA-wvcv-832q-fjg7 tlslite-ng (PyPI) Fixed in 0.7.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26263
  2. 2026-10-03 Alias added: GHSA-wvcv-832q-fjg7

References

Exploit 2

Patch 3

Advisory 2

Other 4

  • TI-2024-15443 python-ecdsa vulnerable to Minerva attack on P-256 CVSS 3.1HIGH 7.4
  • TI-2026-26287 python-ecdsa: Denial of Service via improper DER length validation in crafted private keys CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences