AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Red HatCVE-2026-93578

A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client

Red Hat

CVE-2026-93578 · Published Sep 18, 2026

Medium5.9
No fix yet
Red Hat advisory

A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority (CA), can exploit this by forging 'GOOD' OCSP responses for revoked certificates. This bypasses certificate revocation checks, allowing applications using Netty's OCSP Client to accept certificates that should have been revoked, leading to an authorization bypass.

Affected versions

PackageAffectedFixed in
Red Hat build of Apache Camel for Spring Boot 4
Product
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-1035

More Red Hat advisories

All Red Hat
Critical 9.3Sep 18Red Hat OpenShift console: server-side request forgeryCVE-2026-75885no fix yetMedium 6.5Sep 18Red Hat Netty: request smugglingCVE-2026-93574no fix yetMedium 6.5Sep 18Red Hat Netty: request smugglingCVE-2026-93562no fix yetMedium 6.1Sep 18A flaw was found in cockpit-filesCVE-2026-91202no fix yetMedium 6.0Sep 18Red Hat Enterprise Linux 9: race conditionCVE-2026-91203no fix yetMedium 6.0Sep 18Red Hat cockpit-files: race conditionCVE-2026-91205no fix yet