CVE-2026-119345 Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-119345?
CVE-2026-119345 is a high-severity vulnerability in ultravioletrs cocos, published on 5 Nov 2026.
Official description
Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attached devices after that check can keep the existing connection open while the peer continues trusting stale initial Evidence. This gap is especially significant for long-lived connections because the verifier has no mechanism to detect the changed state. This issue is fixed in version 0.9.0.
Weakness: CWE-367
Which versions are affected by CVE-2026-119345?
1 open source package ship an affected version, including github.com/ultravioletrs/cocos.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ultravioletrs/cocos Go | All versions | 0.9.0 |
How do I fix CVE-2026-119345?
Upgrade github.com/ultravioletrs/cocos to 0.9.0 or later.
Is CVE-2026-119345 being exploited?
There is no known exploitation of CVE-2026-119345 in the wild and no public exploit code.
Sources
Also known as GHSA-ghwv-vrp2-2975.