PYSEC-2026-3676 Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)

🗓️ 19 Aug 2026 11:56:28Reported by GoogleType

osv🔗 osv.dev👁 2 Views

Lemur's SSRF guard for revocation checking is bypassable via HTTP redirects and DNS rebinding by operator-role users.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2026-70667	18 Aug 202622:35	–	circl
CVE	CVE-2026-70667	18 Aug 202618:55	–	cve
Cvelist	CVE-2026-70667 Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)	18 Aug 202618:55	–	cvelist
EUVD	EUVD-2026-61151	18 Aug 202618:55	–	euvd
Github Security Blog	Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)	18 Aug 202620:51	–	github
NVD	CVE-2026-70667	18 Aug 202619:17	–	nvd
OSV	GHSA-54VG-PFH7-JQ95 Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF	25 Jun 202621:58	–	osv
OSV	GHSA-F3QQ-49M6-RW8F Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)	18 Aug 202620:51	–	osv
Positive Technologies	PT-2026-77280	18 Aug 202600:00	–	ptsecurity
PyPA	Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)	19 Aug 202611:56	–	pypa

Source	Link
github	www.github.com/Netflix/lemur/security/advisories/GHSA-f3qq-49m6-rw8f
github	www.github.com/Netflix/lemur/commit/ed504a830f38a83825b1570302e9f38d6553938a
github	www.github.com/Netflix/lemur
github	www.github.com/Netflix/lemur/releases/tag/v1.9.3
pypi	www.pypi.org/project/lemur
github	www.github.com/advisories/GHSA-f3qq-49m6-rw8f
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-70667

19 Aug 2026 12:45Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.16.3

EPSS0.00135