PT-2026-1358 · Badkeys · Badkeys

Hannob · Publicado 2026-01-05 · Atualizado 2026-01-06 · CVE-2026-21439

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions badkeys versions 0.0.15 and below

Description badkeys is a tool and library used for checking cryptographic public keys for known issues. In versions 0.0.15 and below, an attacker can inject content containing ASCII control characters, such as vertical tabs and ANSI escape sequences. This injection can lead to misleading output when using the badkeys command-line tool. This affects scanning DKIM keys (using both --dkim and --dkim-dns options), SSH keys (in --ssh-lines mode), and filenames in various modes.

Recommendations Update to version 0.0.16 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-150

Identificadores relacionados

CVE-2026-21439

GHSA-WJPC-4F29-83H3

Produtos afetados

Badkeys

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21439.json · Exploit
• 🔥 https://github.com/badkeys/badkeys/issues/40 · Exploit
• https://github.com/badkeys/badkeys · Nota
• https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087 · Correção
• https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a · Correção
• https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3 · Nota
• https://twitter.com/VulmonFeeds/status/2008366560964923855 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2008346538708521084 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-21439 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wjpc-4f29-83h3 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-21439 · Nota de Segurança
• https://t.me/CVEtracker/41451 · Publicação no Telegram