{"data":{"id":"3826f58e-873b-4fa9-8083-7be82d385f60","title":"GHSA-ghwv-vrp2-2975: Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks","summary":"Cocos AI's intra-handshake attested TLS implementation performs attestation only once, at connection establishment, so the verifying peer keeps trusting the initial Evidence for the life of a connection. An attacker who can modify the attested workload's code, memory-backed state, or configuration after attestation, without terminating the TLS connection, can make the peer treat stale state as current. The flaw is especially concerning for long-lived connections. Muhammad Usama Sardar found and responsibly disclosed it through formal analysis using ProVerif.","solution":"The proposed workaround is to allow re-attestation of the workload after periodic or user-defined intervals using post-handshake attestation.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-ghwv-vrp2-2975","publishedAt":"2026-11-10T15:56:54.000Z","cveId":"CVE-2026-119345","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/ultravioletrs/cocos@<= 0.8.2 (fixed: 0.9.0)"],"affectedPackageNames":["github.com/ultravioletrs/cocos"],"affectedPackageRefs":["go:github.com/ultravioletrs/cocos"],"affectedVendors":[],"affectedVendorsRaw":["Cocos AI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00117,"epssCheckedAt":"2026-11-10T18:05:32.680Z","kevDateAdded":null,"advisoryAliases":["GHSA-ghwv-vrp2-2975"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-11-10T15:56:54.000Z","fixReleasedAt":"2026-03-27T13:23:52.000Z","daysToFix":-228,"fixCheckedAt":"2026-11-10T18:05:53.843Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity","confidentiality"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/ultravioletrs/cocos","fixedVersion":"0.9.0","matchedVersion":"v0.9.0","fixReleasedAt":"2026-03-27T13:23:52.000Z","daysToFix":-228,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-11-10T18:05:53.838Z"}]}}