DEBIAN-CVE-2026-93578
A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority (CA), can exploit this by forging 'GOOD' OCSP responses for revoked certificates. This bypasses certificate revocation checks, allowing applications using Netty's OCSP Client to accept certificates that should have been revoked, leading to an authorization bypass.
DEBIAN-CVE-2026-93578
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-93578
netty
Source reference: /affected/0/package/name
- Affected versions
- 1:4.1.48-10
Source reference:
/affected/0/versions1:4.1.48-11Source reference:
/affected/0/versions1:4.1.48-12Source reference:
/affected/0/versions1:4.1.48-13Source reference:
/affected/0/versions1:4.1.48-14Source reference:
/affected/0/versions1:4.1.48-15Source reference:
/affected/0/versions1:4.1.48-16Source reference:
/affected/0/versions1:4.1.48-7Source reference:
/affected/0/versions1:4.1.48-7+deb12u1Source reference:
/affected/0/versions1:4.1.48-7+deb12u2Source reference:
/affected/0/versions1:4.1.48-8Source reference:
/affected/0/versions1:4.1.48-9Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
netty
Source reference: /affected/1/package/name
- Affected versions
- 1:4.1.48-10
Source reference:
/affected/1/versions1:4.1.48-10+deb13u1Source reference:
/affected/1/versions1:4.1.48-11Source reference:
/affected/1/versions1:4.1.48-12Source reference:
/affected/1/versions1:4.1.48-13Source reference:
/affected/1/versions1:4.1.48-14Source reference:
/affected/1/versions1:4.1.48-15Source reference:
/affected/1/versions1:4.1.48-16Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
netty
Source reference: /affected/2/package/name
- Affected versions
- 1:4.1.48-10
Source reference:
/affected/2/versions1:4.1.48-11Source reference:
/affected/2/versions1:4.1.48-12Source reference:
/affected/2/versions1:4.1.48-13Source reference:
/affected/2/versions1:4.1.48-14Source reference:
/affected/2/versions1:4.1.48-15Source reference:
/affected/2/versions1:4.1.48-16Source reference:
/affected/2/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "netty",
"purl": "pkg:deb/debian/netty?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1:4.1.48-10",
"1:4.1.48-11",
"1:4.1.48-12",
"1:4.1.48-13",
"1:4.1.48-14",
"1:4.1.48-15",
"1:4.1.48-16",
"1:4.1.48-7",
"1:4.1.48-7+deb12u1",
"1:4.1.48-7+deb12u2",
"1:4.1.48-8",
"1:4.1.48-9"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93578.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "netty",
"purl": "pkg:deb/debian/netty?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1:4.1.48-10",
"1:4.1.48-10+deb13u1",
"1:4.1.48-11",
"1:4.1.48-12",
"1:4.1.48-13",
"1:4.1.48-14",
"1:4.1.48-15",
"1:4.1.48-16"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93578.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "netty",
"purl": "pkg:deb/debian/netty?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1:4.1.48-10",
"1:4.1.48-11",
"1:4.1.48-12",
"1:4.1.48-13",
"1:4.1.48-14",
"1:4.1.48-15",
"1:4.1.48-16"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93578.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #58582 · Revision 1
- Added to Heist Feed
- Publisher date