CVE-2010-4237: Mercurial Improper Certificate Validation vulnerability
Summary
CVE-2010-4237: Mercurial Improper Certificate Validation vulnerability. Affects mercurial versions < 1.6.4. Fixed in 1.6.4. How to fix ↓
Also tracked for
- mercurial · Debian:11
The same CVE-2010-4237 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mercurial is a distributed version control system (DVCS) that provides fast and efficient handling of projects of any size. It is written in Python and is widely used for managing source code repositories. Mercurial supports various network protocols, including HTTP, HTTPS, and SSH, for secure communication between clients and servers. However, prior to version 1.6.4, Mercurial fails to properly verify the Common Name field of SSL certificates, making it vulnerable to man-in-the-middle attacks.
Vulnerability Detail
The vulnerability in Mercurial arises from its failure to validate the Common Name field of SSL certificates. This allows remote attackers who possess a certificate signed by a Certificate Authority to intercept and modify the communication between Mercurial clients and servers. By performing a man-in-the-middle attack, an attacker can potentially gain unauthorized access to sensitive information or manipulate the version control system's operations. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Latest published version: 7.2.4 as of 22 Oct 2026
pip install --upgrade "mercurial==7.2.4"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.4
This is the first release that contains the fix.
pip install --upgrade "mercurial==1.6.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of Mercurial.
Conclusion
The Mercurial Improper Certificate Validation vulnerability (CVE-2010-4237) exposes users of Mercurial to the risk of man-in-the-middle attacks. To mitigate this vulnerability, it is crucial to upgrade to Mercurial version 1.6.4 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mercurial →
FAQ
Mercurial is a distributed version control system (DVCS) used for managing source code repositories.
The Common Name (CN) field in an SSL certificate is used to specify the domain name or IP address for which the certificate is issued. It helps establish the identity of the server during SSL/TLS handshake.
A man-in-the-middle (MITM) attack is a type of cyber attack where an attacker intercepts and alters the communication between two parties without their knowledge. In the context of this vulnerability, an attacker can intercept the communication between Mercurial clients and servers, potentially gaining unauthorized access or manipulating the version control system's operations.
The consequences of this vulnerability include unauthorized access to sensitive information, manipulation of version control operations, and potential compromise of the integrity and confidentiality of the source code managed by Mercurial.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Mercurial installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for mercurial.
