Vulnerability · Published Jul 17, 2026 · Assigned by GitHub_M

CVE-2026-53712SCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithms

High 8.2

In plain English

A high-severity security flaw in scram from ongres. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.3%top 82.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to 3.3, a flaw in com.ongres.scram:scram-client and com.ongres.scram:scram-common allows an attacker capable of a TLS man-in-the-middle attack to silently downgrade a connection from SCRAM-SHA-256-PLUS with channel binding to standard SCRAM-SHA-256 without channel binding when TlsServerEndpoint processes an X.509 certificate using a modern signature algorithm such as Ed25519; getChannelBindingData() can return an empty byte array after NoSuchAlgorithmException, and the ScramClient builder treats that as absent channel-binding data. This issue is fixed in version 3.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.ongres.scram:scram-client	3.3	GHSA-p9jg-fcr6-3mhf
Maven	com.ongres.scram:scram-common	3.3	GHSA-p9jg-fcr6-3mhf

Affected products (as reported)

Vendor	Product	Versions
ongres	scram	< 3.3

Weakness: CWE-636, CWE-757 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

References

https://github.com/ongres/scram/security/advisories/GHSA-p9jg-fcr6-3mhf x_refsource_CONFIRM
https://github.com/ongres/scram/releases/tag/3.3 x_refsource_MISC