https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T15:23:02.251187+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-93578 fkie_cve-2026-93578 2026-09-29T15:23:02.288144+00:00

A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority (CA), can exploit this by forging 'GOOD' OCSP responses for revoked certificates. This bypasses certificate revocation checks, allowing applications using Netty's OCSP Client to accept certificates that should have been revoked, leading to an authorization bypass.

 https://vulnerability.circl.lu/vuln/ghsa-4wrp-2fvc-9x8r GHSA-4wrp-2fvc-9x8r 2026-09-29T15:23:02.288398+00:00

Missing Extended Key Usage (EKU) check in OCSP Client allows certificate revocation bypass

 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11882-1 openSUSE-SU-2026:11882-1 — netty-4.1.138-1.1 on GA media 2026-09-29T15:23:02.288425+00:00

netty-4.1.138-1.1 on GA media

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-93578 UBUNTU-CVE-2026-93578 2026-09-29T15:23:02.288481+00:00

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:Pro:26.04:LTS: netty

A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority (CA), can exploit this by forging 'GOOD' OCSP responses for revoked certificates. This bypasses certificate revocation checks, allowing applications using Netty's OCSP Client to accept certificates that should have been revoked, leading to an authorization bypass.