A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority (CA), can exploit this by forging 'GOOD' OCSP responses for revoked certificates. This bypasses certificate revocation checks, allowing applications using Netty's OCSP Client to accept certificates that should have been revoked, leading to an authorization bypass.
References
Configurations
No configuration.
History
18 Sep 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority (CA), can exploit this by forging 'GOOD' OCSP responses for revoked certificates. This bypasses certificate revocation checks, allowing applications using Netty's OCSP Client to accept certificates that should have been revoked, leading to an authorization bypass. |
18 Sep 2026, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/security/cve/CVE-2026-93578 - |
18 Sep 2026, 14:19
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.9 |
18 Sep 2026, 11:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-18 11:17
Updated : 2026-09-18 19:06
NVD link : CVE-2026-93578
Mitre link : CVE-2026-93578
CVE.ORG link : CVE-2026-93578
JSON object : View
Products Affected
No product.
CWE
CWE-1035
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities