CVE-2026-129482

CVSS 6.3 (medium) · published 2026-11-15

OkHttp through 5.5.1 contains an improper certificate validation vulnerability in CertificatePinner that skips pin checks because Pin.matchesHostname does not normalize trailing-dot hostnames. Network attackers with a CA-trusted certificate not matching configured pins can intercept or modify TLS traffic when applications request the trailing-dot form of pinned hosts.

Weakness: CWE-295

Source: NVD CVE-2026-129482

References

• https://github.com/lysine-dev/okhttp/blob/parent-5.5.1/okhttp/src/commonJvmAndroid/kotlin/okhttp3/CertificatePinner.kt#L293-L314
• https://github.com/lysine-dev/okhttp/commit/30aa589761a9b4f5fe84c00e21e5ab44b22bd7c1
• https://github.com/lysine-dev/okhttp/issues/9724
• https://github.com/lysine-dev/okhttp/pull/9734
• https://www.vulncheck.com/advisories/okhttp-through-5.5.1-certificate-pinning-bypass-via-trailing-dot-hostname

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.