CVE-2026-21439 LOW

CVE-2026-21439: badkeys vulnerable to ASCII control character injection on console via malformed input

Vendor Badkeys
Product badkeys
Weakness CWE-150
Published January 5, 2026
Last update January 6, 2026

CVSS base score

2.0/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the badkeys command-line tool. This impacts scanning DKIM keys (both --dkim and --dkim-dns), SSH keys (--ssh-lines mode), and filenames in various modes. This issue is fixed in version 0.0.16.

Key dates

02Disclosure timeline

January 5, 2026 CVE published
January 6, 2026 Record updated