CVE-2021-3618

CVE-2021-3618, known as ALPACA, is an application layer protocol content confusion attack affecting TLS servers that use compatible certificates for different protocols, such as multi-domain or wildcard certificates. A Man-in-the-Middle attacker can redirect traffic between subdomains, leading to valid but misdirected TLS sessions, potentially enabling cross-protocol attacks. This vulnerability has a CVSS score of 7.4 (HIGH) due to its network-based attack vector, high impact on confidentiality and integrity, and high attack complexity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.