CVE-2026-93578: Missing EKU Check in OCSP Client Allows Revocation Bypass
CVE-2026-93578 Published on September 18, 2026
Io.netty/netty-handler-ssl-ocsp: netty: missing extended key usage (eku) check in ocsp client allows certificate revocation bypass
A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority (CA), can exploit this by forging 'GOOD' OCSP responses for revoked certificates. This bypasses certificate revocation checks, allowing applications using Netty's OCSP Client to accept certificates that should have been revoked, leading to an authorization bypass.
Vulnerability Analysis
CVE-2026-93578 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-93578. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public.
Weakness Type
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Products Associated with CVE-2026-93578
stack.watch emails you whenever new vulnerabilities are published in Red Hat Camel Spring Boot or Oracle. Just hit a watch button to start following.
