ALPINE-CVE-2026-12490

ALPINE-CVE-2026-12490

This page contains facts from public vulnerability sources. Check the original advisory before updating.

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.

CVSS 7.5 · High · Fix available

Published

2026-06-25T07:16:45.330Z

Updated

2026-10-01T02:17:49.176060984Z

Stack: system

Check your server →