CVE-2026-70667

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.3

Description An issue exists in the validate revocation url function within lemur/certificates/verify.py during the validation of CRL (Certificate Revocation List) or OCSP (Online Certificate Status Protocol) URLs. The requests.get call for CRLs follows HTTP redirects without validating each Location target, allowing a public attacker-controlled URL to redirect requests to loopback, RFC1918, link-local, or instance-metadata addresses. Additionally, separate DNS resolutions for validation and connection create a time-of-check time-of-use (TOCTOU) window, enabling DNS rebinding on both CRL and OCSP paths. A user uploading a certificate via the 'POST /api/1/certificates/upload' endpoint could induce blind internal requests. DNS rebinding is a technique where a DNS server changes the IP address associated with a domain name between the time it is validated and the time it is used.

Recommendations Update to version 1.9.3.