CVE-2026-93578: Netty: netty-handler-ssl-ocsp: io.netty/netty-handler-ssl-ocsp: netty: missing extended key usage (eku) check in ocsp client allows certificate revocation bypass
Published Sep 18, 2026
·Updated
Missing Extended Key Usage (EKU) check in OCSP Client allows certificate revocation bypass
Affected Software
2 affected components
Netty io.netty/netty-handler-ssl-ocsp>=4.2.0.Final<=4.2.17.Final
io.netty/netty-handler-ssl-ocsp>=4.1.0.Final<=4.1.137.Final
Event History
Sep 18, 2026
Data Sourced
via Red Hat·10:35 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·10:53 AM
Data Sourced
via MITRE·10:53 AM
DescriptionWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker needs any valid certificate issued by the same CA. They can use it to sign a forged "GOOD" OCSP response for a revoked certificate because the responder certificate's OCSP-signing EKU is not checked.
2
Which deployments are exposed?
Deployments using Netty's io.netty.handler.ssl.ocsp.OcspClient and relying on its OCSP responses for certificate revocation checking are exposed. The issue concerns validation of delegated OCSP responder certificates.