Common Weakness Enumeration
CWE-299 Improper Check for Certificate Revocation
Description
The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-299 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-g7hg-vrcf-mvmr | CVE-2026-56821 | HIGH |
Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator |
2026-07-22 | |
| GHSA-cm26-5974-52h8 | CVE-2026-61699 | HIGH |
nebula-mesh: Certificate revocation is never enforced at the mesh |
2026-07-14 | |
| GHSA-8f6j-263m-g72x | - | MODERATE |
Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks |
2026-07-13 | |
| GHSA-g27r-r6ph-vf5r | - | LOW | - |
sequoia-git has broken hard revocation handling |
2026-05-04 |
| GHSA-pwjx-qhcg-rvj4 | - | MODERATE | - |
webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic |
2026-03-25 |
| GHSA-45v3-38pc-874v | CVE-2024-56138 | MODERATE |
notation-go's timestamp signature generation lacks certificate revocation check |
2025-01-14 |