{"id":"EUVD-2026-37821","enisaUuid":"edbc5c10-c4e6-3f46-a631-46efb4d0ecd6","description":"Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encryption 4.0.0 through 4.1.0, configuring `encrypt:rsa:algorithm\u003dOAEP` does not enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the `OAEP` setting selects PKCS#1 v1.5, which is the same algorithm as the `DEFAULT` setting. Steeltoe.Configuration.Encryption version 4.2.0 patches the issue.","datePublished":"Jun 17, 2026, 10:01:19 PM","dateUpdated":"Jun 18, 2026, 1:53:58 PM","baseScore":1.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-4j9m-h44m-2hv8\nhttps://github.com/SteeltoeOSS/Steeltoe/commit/6cfee5cccddf8f9a31de69b0ca5ccdd771b73e5b\n","aliases":"CVE-2026-50268\nGHSA-4j9m-h44m-2hv8\n","assigner":"GitHub_M","epss":0.05,"enisaIdProduct":[{"id":"477a6a39-8bb8-3523-9920-9c9fdda0e453","product":{"name":"Steeltoe.Configuration.Encryption","vendor":{"name":"SteeltoeOSS"}},"product_version":"4.0.0, \u003c 4.2.0"}],"enisaIdVendor":[{"id":"217f0393-4dfe-3a51-9738-d0b82efc5513","vendor":{"name":"SteeltoeOSS"}}],"enisaIdVulnerability":[{"id":"01f12fd1-9c9d-3b86-b996-f8daa6ca0b14","vulnerability":{"id":"CVE-2026-50268","description":"Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encryption 4.0.0 through 4.1.0, configuring `encrypt:rsa:algorithm\u003dOAEP` does not enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the `OAEP` setting selects PKCS#1 v1.5, which is the same algorithm as the `DEFAULT` setting. Steeltoe.Configuration.Encryption version 4.2.0 patches the issue.","datePublished":"Jun 17, 2026, 10:01:19 PM","dateUpdated":"Jun 18, 2026, 1:53:58 PM","status":"PUBLISHED","baseScore":1.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-4j9m-h44m-2hv8\nhttps://github.com/SteeltoeOSS/Steeltoe/commit/6cfee5cccddf8f9a31de69b0ca5ccdd771b73e5b\n","enisa_id":"EUVD-2026-37821\n","assigner":"GitHub_M","epss":0.05,"dataProcessed":"Nov 3, 2026, 7:15:30 AM","vulnerabilityProduct":[{"id":"b8fa9794-f19f-3d9f-8234-1ae4f63ae8ab","product":{"name":"Steeltoe.Configuration.Encryption","vendor":{"name":"SteeltoeOSS"}},"product_version":"4.0.0, \u003c 4.2.0"}],"vulnerabilityVendor":[{"id":"54a28ba2-7739-35e6-ac8c-4b0c368dd454","vendor":{"name":"SteeltoeOSS"}}]}},{"id":"a5906af2-7013-3342-ac14-18aa7debafec","vulnerability":{"id":"GHSA-4j9m-h44m-2hv8","description":"Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding","datePublished":"Jul 2, 2026, 8:32:21 PM","dateUpdated":"Jul 2, 2026, 8:32:21 PM","baseScore":0.0,"references":"https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-4j9m-h44m-2hv8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-50268\nhttps://github.com/SteeltoeOSS/Steeltoe/commit/6cfee5cccddf8f9a31de69b0ca5ccdd771b73e5b\nhttps://github.com/SteeltoeOSS/security-advisories\n","enisa_id":"EUVD-2026-37821\n","aliases":"CVE-2026-50268\nGHSA-4j9m-h44m-2hv8\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}