CVE-2026-53602

CVE-2026-53602 affects nebula-mesh , a self-hosted control plane for Slack Nebula mesh VPN (github.com/forgekeep/nebula-mesh), prior to version 0.3.7 . The core issue is that host revocation is not durable : blocked or offboarded hosts can regain a fresh, valid Nebula certificate because nebula-m...

CVE-2026-85525

A flaw was found in Snowflake drivers, including Python, Go, JDBC, and Node.js. This flaw involves improper Online Certificate Status Protocol OCSP response validation, which allows a revoked Transport Layer Security TLS certificate to be accepted as valid. A man-in-the-middle attacker, possessin...

Linux Distros Unpatched Vulnerability : CVE-2026-84964

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already...

DEBIAN-CVE-2026-84964

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated part...

EUVD-2026-70514

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated part...

CVE-2026-84964

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated part...

OCSP Response Validation Bypass

Bouncy Castle for Java is vulnerable to an OCSP response validation bypass. The vulnerability is due to the failure to properly associate the stapled OCSP response with the intended certificate, which allows an attacker to exploit the validation process by providing a valid OCSP response for a...

Astra Linux – Vulnerability in Thunderbird

The OCSP revocation status of recipient certificates was not checked when sending S/MIME encrypted emails. As a result, revoked certificates were accepted. This bug affected Thunderbird versions from 68 to 102.9.1. This vulnerability affects Thunderbird versions earlier than 102.10...

Astra Linux – Vulnerability in curl

Curl versions 7.41.0 through 7.73.0 are vulnerable to a flaw related to improper checks for certificate revocation, due to insufficient verification of the OCSP response...

GHSA-PXMC-2FFP-8J67 Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

Summary Repo under test: https://github.com/Netflix/lemur PUT /api/1/certificates//revoke authorizes the caller against the Lemur database row creator == current user, or CertificatePermission over the row's roles rather than the underlying CA-side certificate identity. Separately, POST...

GHSA-F3QQ-49M6-RW8F Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)

Summary The SSRF mitigation added for GHSA-54vg-pfh7-jq95 validaterevocationurl in lemur /certificates/verify.py can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations RFC1918, loopback,...

CVE-2026-71417

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authorityid, serial, or externalid without requiring permission on the underlying authority. PUT /api/1/certificates//revo...

CVE-2026-71417

In Lemur before 1.9.3, a non-read-only user could upload a duplicate certificate row bypassing CertificatePermission, then revoke it via PUT /api/1/certificates//revoke, causing issuer plugins to revoke the real CA-side certificate and causing fleet-wide TLS denial of service. Fixed in 1.9.3. No ...

CVE-2026-71417 Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authorityid, serial, or externalid without requiring permission on the underlying authority. PUT /api/1/certificates//revo...

EUVD-2026-61161

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authorityid, serial, or externalid without requiring permission on the underlying authority. PUT /api/1/certificates//revo...

CVE-2026-71417 Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authorityid, serial, or externalid without requiring permission on the underlying authority. PUT /api/1/certificates//revo...

CVE-2026-70667 Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)

Lemur manages TLS certificate creation. Prior to 1.9.3, validaterevocationurl in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, ...

CVE-2026-70667 Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)

Lemur manages TLS certificate creation. Prior to 1.9.3, validaterevocationurl in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, ...

CVE-2026-70667

Netflix Lemur prior to 1.9.3 contains a bypass of its SSRF mitigation in _validate_revocation_url (lemur/certificates/verify.py). Two vectors exist: (1) the CRL requests.get call follows HTTP redirects without re-validating each Location target, allowing an attacker-controlled public URL to redir...

io.netty/netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack

A flaw was found in Netty. The OcspClient component fails to validate that the Certificate ID in an Online Certificate Status Protocol OCSP response matches the requested Certificate ID. This vulnerability allows a remote attacker to bypass certificate revocation checks by presenting a legitimate...