Security Flaw in Netty's OCSP Handler Allows Certificate Bypass
CVE-2026-93493

5.9MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Apache Camel For Spring Boot 4
Vendor
CVE Published:
18 September 2026

What is CVE-2026-93493?

A flaw in Netty's netty-handler-ssl-ocsp component exposes applications to potential security risks by allowing a remote attacker to exploit the system. Specifically, when an Online Certificate Status Protocol (OCSP) response omits the optional nextUpdate field, the validation process is silently skipped. This allows applications to proceed with using an unvalidated certificate, undermining security controls that rely on proper certificate validation.

References

https://access.redhat.com/security/cve/CVE-2026-93493
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2536897
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.