ongres scram up to 3.2 SCRAM Client getChannelBindingData downgrade

Summaryinfo

A vulnerability was found in ongres scram up to 3.2 and classified as problematic. Affected by this issue is the function getChannelBindingData of the component SCRAM Client. The manipulation results in downgrade. This vulnerability was named CVE-2026-53712. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic has been found in ongres scram up to 3.2. Affected is the function getChannelBindingData of the component SCRAM Client. The manipulation with an unknown input leads to a downgrade vulnerability. CWE is classifying the issue as CWE-757. A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. This is going to have an impact on confidentiality. CVE summarizes:

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to 3.3, a flaw in com.ongres.scram:scram-client and com.ongres.scram:scram-common allows an attacker capable of a TLS man-in-the-middle attack to silently downgrade a connection from SCRAM-SHA-256-PLUS with channel binding to standard SCRAM-SHA-256 without channel binding when TlsServerEndpoint processes an X.509 certificate using a modern signature algorithm such as Ed25519; getChannelBindingData() can return an empty byte array after NoSuchAlgorithmException, and the ScramClient builder treats that as absent channel-binding data. This issue is fixed in version 3.3.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-53712 since 06/10/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1562.010.

Upgrading to version 3.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• ongres

Name

• scram

Version

• 3.0
• 3.1
• 3.2

Website

• Product: https://github.com/ongres/scram/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion