CVE Catalog
CVE-2026-42508
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk0.57%
45th percentile - higher than 45% of all known CVEs
Summary
Vulnerability in the revocation mechanism of 'SignatureKey' belonging to a CA. Previously, a revoked key was not correctly checked; now both 'key' and 'key.SignatureKey' are verified for revocation.
Risk Assessment
The organization may be exposed to the use of a revoked key, potentially leading to trust breaches in certificates and man-in-the-middle attacks.
Recommendation
Update the system to a version where the revocation check for 'SignatureKey' keys is fixed.
Original NVD description (English source)
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.