TLS Certificate Management Vulnerability in Lemur by Netflix

CVE-2026-55162

What is CVE-2026-55162?

Lemur, a tool for managing TLS certificates, had a vulnerability that allowed an authenticated operator to perform actions that could compromise internal network security. Specifically, it mishandled CRL Distribution Point and OCSP responder URLs during certificate uploads by not adequately validating the destination of these requests. This flaw could lead to probing of internal services from locations like loopback or link-local addresses. Additionally, the CRL path utilized an unbounded cache, allowing potentially malicious entries to consume memory resources. The vulnerability was addressed in version 1.9.2, which introduced proper destination validation and bounded caching practices.

References