Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-93578

Red Hat build of Apache Camel for Spring Boot 4 · Vulnerability

CVSS 3.1 5.9 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-93578

Published

A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority (CA), can exploit this by forging 'GOOD' OCSP responses for revoked certificates. This bypasses certificate revocation checks, allowing applications using Netty's OCSP Client to accept certificates that should have been revoked, leading to an authorization bypass.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-93578

Published

netty-handler-ssl-ocsp

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Apache Camel for Spring Boot 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "netty-handler-ssl-ocsp",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:camel_spring_boot:4"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON