CVE-2026-86231

Name of the Vulnerable Software and Affected Versions mwiede jsch versions prior to 2.28.6

Description A security flaw exists in the getRevokedKeys() function within the src/main/java/com/jcraft/jsch/KnownHosts.java file. A remote attacker can manipulate the known hosts argument to cause an improper check for certificate revocation. This attack is characterized by high complexity and is difficult to exploit.

Recommendations Upgrade to version 2.28.6.