CVE-2026-93493

Published: Sep 18, 2026Modified: Sep 18, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.2 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol (OCSP) response that omits the optional `nextUpdate` field. This omission causes the OCSP validation to be silently skipped, leading to applications proceeding with an unvalidated certificate. This can result in a bypass of security controls where certificate validation is expected.

Related CWEs

CWE-299

Improper Check for Certificate Revocation

The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.

References (2)

https://access.redhat.com/security/cve/CVE-2026-93493

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2536897

Source: secalert@redhat.com

Timeline

No history available yet.