CVE-2026-93578

Name of the Vulnerable Software and Affected Versions Netty (affected versions not specified)

Description A flaw exists in the Online Certificate Status Protocol (OCSP) Client, which is a protocol used for obtaining the real-time revocation status of digital certificates. The client fails to verify the id-kp-OCSPSigning Extended Key Usage (EKU), a specific attribute that identifies a certificate as being authorized to sign OCSP responses. A remote attacker possessing any valid certificate issued by the same Certificate Authority (CA) can forge 'GOOD' OCSP responses for revoked certificates. This allows the application to accept revoked certificates, resulting in an authorization bypass.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.