CWE · MITRE source
CWE-297Improper Validation of Certificate with Host Mismatch
The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
Even if a certificate is well-formed, signed, and follows the chain of trust, it may simply be a valid certificate for a different site than the site that the product is interacting with. In order to ensure data integrity, the certificate must be valid, and it must pertain to the site that is being accessed. Even if the product attempts to check the hostname, it is still possible to incorrectly check the hostname. For example, attackers could create a certificate with a name that begins with a trusted name followed by a NUL byte, which could cause some string-based comparisons to only examine the portion that contains the trusted name.
Last updated: 16 October 2026 14:24 UTC
OWASP Top 10 for Web (2025)
This weakness contributes to A07:2025 Authentication Failures.
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
SC-17Public Key Infrastructure CertificatesPR.AA-03PR.DS-02PR.PS-06
—
—
V17.2.8
NIST 800-53 r5 controls PROPOSED for this weakness (1)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-17 | Public Key Infrastructure Certificates | SC | Approved PKI issuance and trust stores enforce full certificate validation steps including name/hostname checks. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2025-46408 UPD | 7.4 | 9.8 | 0.0066 | 2025-09-15 |
CVE-2020-1887 UPD | 7.2 | 9.1 | 0.0157 | 2020-03-13 |
CVE-2021-33695 UPD | 6.9 | 9.1 | 0.0056 | 2021-09-15 |
CVE-2026-48144 | 6.8 | 9.1 | 0.0040 | 2026-07-27 |
CVE-2021-21385 UPD | 6.7 | 8.8 | 0.0074 | 2021-03-24 |
CVE-2025-68637 UPD | 6.7 | 9.1 | 0.0025 | 2026-01-07 |
CVE-2026-49457 UPD | 6.7 | 9.1 | 0.0025 | 2026-08-14 |
CVE-2026-88647 | 6.7 | 9.1 | 0.0021 | 2026-10-08 |
CVE-2018-10936 UPD | 6.6 | 8.1 | 0.0291 | 2018-08-30 |
CVE-2026-107938 | 6.6 | 9.1 | 0.0018 | 2026-10-09 |
CVE-2020-11050 UPD | 6.5 | 9.0 | 0.0079 | 2020-05-07 |
CVE-2022-32153 UPD | 6.3 | 8.1 | 0.0092 | 2022-06-15 |
CVE-2025-3501 UPD | 6.2 | 8.2 | 0.0046 | 2025-04-29 |
CVE-2026-42790 UPD | 6.1 | 8.1 | 0.0047 | 2026-05-27 |
CVE-2026-92943 | 6.1 | 8.1 | 0.0038 | 2026-09-17 |
CVE-2024-34447 UPD | 6.0 | 7.5 | 0.0077 | 2024-05-03 |
CVE-2025-2190 UPD | 6.0 | 8.1 | 0.0034 | 2025-03-11 |
CVE-2026-84393 UPD | 6.0 | 8.1 | 0.0028 | 2026-09-08 |
CVE-2020-14387 UPD | 5.9 | 7.4 | 0.0111 | 2021-05-27 |
CVE-2026-43869 UPD | 5.9 | 7.3 | 0.0081 | 2026-05-05 |
CVE-2026-35563 UPD | 5.9 | 8.5 | 0.0026 | 2026-06-01 |
CVE-2026-54275 | 5.9 | 7.5 | 0.0047 | 2026-06-22 |
CVE-2026-65942 UPD | 5.9 | 7.5 | 0.0059 | 2026-08-10 |
CVE-2023-5909 UPD | 5.8 | 7.5 | 0.0044 | 2023-11-30 |
CVE-2026-12064 UPD | 5.8 | 7.5 | 0.0040 | 2026-07-03 |