Security Flaw in Netty's OCSP Handler Allows Certificate Bypass
CVE-2026-93493

Currently unrated

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Apache Camel For Spring Boot 4
Vendor
CVE Published:
18 September 2026

What is CVE-2026-93493?

A flaw in Netty's netty-handler-ssl-ocsp component exposes applications to potential security risks by allowing a remote attacker to exploit the system. Specifically, when an Online Certificate Status Protocol (OCSP) response omits the optional nextUpdate field, the validation process is silently skipped. This allows applications to proceed with using an unvalidated certificate, undermining security controls that rely on proper certificate validation.

References

https://access.redhat.com/security/cve/CVE-2026-93493
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2536897
issue-trackingx_refsource_REDHAT

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.