CVE-2010-4237: Mercurial

Medium severity, CVSS 5.9. EPSS: 0.8% chance of exploitation in the next 30 days.

Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.

Affected products

• Mercurial Mercurial: before 1.6.4 (fixed in 1.6.4)

Published 2019-10-29. Last modified 2026-06-16.