> CVE-2026-93493

« BACK_TO_HOME
PUBLISHED
2026-09-18 08:17
MODIFIED
2026-09-18 08:17
EPSS (Prob. Exploit)
0.22%
Top 88.6%
DATA SOURCES:
NVD 🔗 2026-09-18 CWE MITRE 🔗 2026-10-01 FIRST EPSS 🔗 2026-10-18

> DESCRIPTION

A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol (OCSP) response that omits the optional `nextUpdate` field. This omission causes the OCSP validation to be silently skipped, leading to applications proceeding with an unvalidated certificate. This can result in a bypass of security controls where certificate validation is expected.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-299

> CWE DETAILED DESCRIPTIONS

CWE-299: Improper Check for Certificate Revocation - The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.

> HISTORIQUE DES MODIFICATIONS

Première apparition
18/09/2026 08:17
Source: NVD
📊 ENRICHISSEMENT 01/10/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-299: Improper Check for Certificate Revocation - The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been comp...
Total des modifications: 1 Dernière mise à jour: 3 weeks ago

> REFERENCES

https://access.redhat.com/security/cve/CVE-2026-93493
https://bugzilla.redhat.com/show_bug.cgi?id=2536897
« BACK_TO_HOME