CVE-2016-10027

Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and trigger use of cleartext for client authentication by stripping the "starttls" feature from a server response.

• CWE-362

• http://www.openwall.com/lists/oss-security/2016/12/22/12Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/95129Third Party Advisory, VDB Entry
• https://community.igniterealtime.org/blogs/ignite/2016/11/22/smack-security-advisory-2016-11-22Vendor Advisory
• https://github.com/igniterealtime/Smack/commit/059ee99ba0d5ff7758829acf5a9aeede09ec820bPatch, Third Party Advisory
• https://github.com/igniterealtime/Smack/commit/a9d5cd4a611f47123f9561bc5a81a4555fe7cb04Patch, Third Party Advisory
• https://issues.igniterealtime.org/projects/SMACK/issues/SMACK-739Issue Tracking, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4WXAZ4JVJXHMEDDXJVWJHPVBF5QCTZF/
• http://www.openwall.com/lists/oss-security/2016/12/22/12Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/95129Third Party Advisory, VDB Entry
• https://community.igniterealtime.org/blogs/ignite/2016/11/22/smack-security-advisory-2016-11-22Vendor Advisory
• https://github.com/igniterealtime/Smack/commit/059ee99ba0d5ff7758829acf5a9aeede09ec820bPatch, Third Party Advisory
• https://github.com/igniterealtime/Smack/commit/a9d5cd4a611f47123f9561bc5a81a4555fe7cb04Patch, Third Party Advisory
• https://issues.igniterealtime.org/projects/SMACK/issues/SMACK-739Issue Tracking, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4WXAZ4JVJXHMEDDXJVWJHPVBF5QCTZF/

Published

Jan 12, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10021Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-10022Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-10023Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-10024Xen through 4.8.x allows local x86 PV guest OS kernel admini…
• CVE-2016-10025VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems u…
• CVE-2016-10026ikiwiki 3.20161219 does not properly check if a revision cha…
• CVE-2016-10028The virgl_cmd_get_capset function in hw/display/virtio-gpu-3…5.5
• CVE-2016-10029The virtio_gpu_set_scanout function in QEMU (aka Quick Emula…5.5
• CVE-2016-1003Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-10030The _prolog_error function in slurmd/req.c in Slurm before 1…
• CVE-2016-10031WampServer 3.0.6 installs two services called 'wampapache' a…
• CVE-2016-10033The mailSend function in the isMail transport in PHPMailer b…9.8