CVE-2010-4237: Mercurial Improper Certificate Validation Vulnerability
Summary
CVE-2010-4237: Mercurial Improper Certificate Validation vulnerability. Affects mercurial versions < 1.6.4. Fixed in 1.6.4. How to fix ↓
Also tracked for
- mercurial · Debian:11
The same CVE-2010-4237 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mercurial is a distributed version control system that allows developers to manage and track changes in their codebase efficiently. It is widely used for software development due to its speed and flexibility. However, prior to version 1.6.4, Mercurial had a critical vulnerability related to SSL certificate validation, which could expose users to man-in-the-middle attacks.
Vulnerability Detail
The vulnerability arises from Mercurial's failure to properly verify the Common Name (CN) field of SSL certificates. This oversight allows attackers who possess a valid certificate from a trusted Certificate Authority to intercept and manipulate communications between the user and the server. As a result, sensitive data could be compromised, leading to potential unauthorized access or data breaches.
How To Fix
Latest published version: 7.2.4 as of 22 Oct 2026
pip install --upgrade "mercurial==7.2.4"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.4
This is the first release that contains the fix.
pip install --upgrade "mercurial==1.6.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using SSL connections until they have updated to the patched version. This can be done by configuring Mercurial to use an alternative transport method that does not rely on SSL.
Conclusion
The Mercurial improper certificate validation vulnerability (CVE-2010-4237) poses a significant risk to users who have not updated to version 1.6.4 or later. It is crucial to apply the necessary updates to safeguard against potential man-in-the-middle attacks and protect sensitive data.
See every vulnerability recorded for mercurial →
FAQ
CVE-2010-4237 is a vulnerability in Mercurial that involves improper validation of SSL certificates, potentially allowing man-in-the-middle attacks.
You can check your version of Mercurial by running hg --version in your terminal. If your version is below 1.6.4, it is affected.
Failing to fix this vulnerability can lead to unauthorized access to your data, as attackers can intercept and manipulate your communications.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software without requiring access to the code or installation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for mercurial.
