CVE-2026-93578

5.9 Moyenne

Publiée le 18/09/2026 à 13:17 · Modifiée le 18/09/2026 à 21:06 · En attente d'analyse NVD · Source : secalert@redhat.com

Description

A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority (CA), can exploit this by forging 'GOOD' OCSP responses for revoked certificates. This bypasses certificate revocation checks, allowing applications using Netty's OCSP Client to accept certificates that should have been revoked, leading to an authorization bypass.

Traduire en français

Produits concernés

Red Hat build of Apache Camel for Spring Boot 4

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.9 Moyenne	secalert@redhat.com	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N`

Faiblesses (CWE)

CWE-1035

Références

https://access.redhat.com/security/cve/CVE-2026-93578
https://bugzilla.redhat.com/show_bug.cgi?id=2536969
https://access.redhat.com/security/cve/CVE-2026-93578

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories