CWE-299.

JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3…

• JetBrains IntelliJ IDEA
• JetBrains PyCharm
• CWE-299

Distrust compromised intermediate certificates in ssl module

• Python Software Foundation CPython
• CWE-299

Electron: Mitigation for compromised eMudhra intermediate certificates

• CWE-299

<42.11.16 || >=43.0.0-alpha.1, <43.8.1 || >=44.0.0-alpha.1, <44.9.1 || >=45.0.0-alpha.1, <45.0.0-beta.6 · fixed in 42.11.16, 43.8.1, 44.9.1, 45.0.0-beta.6

Distrust compromised intermediate certificates in crypto/x509

• CWE-299

<1.26.10 || >=1.27.0-0, <1.27.3 · fixed in 1.26.10, 1.27.3

Secure Boot Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-299

CRL check skipped when OCSP enabled and certificate has no OCSP URL

• wolfSSL
• CWE-299

Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore

• Apache Software Foundation Apache Tomcat
• CWE-299

Io.netty/netty-handler-ssl-ocsp: netty: ocsp validation silently skipped when a response omits the optional nextupdate field

• Red Hat build of Apache Camel for Spring Boot 4
• CWE-299

mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation

• mwiede jsch
• CWE-298
• CWE-299

Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

• CWE-299

>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

nebula-mesh: Certificate revocation is never enforced at the mesh

• CWE-299
• CWE-672

<0.7.1 · fixed in 0.7.1

Rockwell Automation CompactLogix® 5380 ControlLogix® 5580 / 1756-EN4 Communications Module – Certificate Revocation List Vulnerability

• Rockwell Automation ControlLogix® 5580, CompactLogix® 5380, GuardLogix® 5580, Compact GuardLogix® 5380, 1756-EN4TR
• CWE-299

Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks

• Weak cryptography or TLS
• CWE-299

>=0.2.0, <3.1.2 · fixed in 3.1.2

Improper Check for Certificate Revocation in S2OPC

• Systerel S2OPC
• CWE-299

sequoia-git has broken hard revocation handling

• CWE-299

<0.6.0 · fixed in 0.6.0

CRL Distribution Point Scope Check Logic Error in AWS-LC

• Weak cryptography or TLS
• CWE-299

>=0.13.0, <0.13.13 · fixed in 0.13.13

CRLs not considered authoritative by Distribution Point due to faulty matching logic

• CWE-299

>=0.102.0-alpha.0, <0.103.10 · fixed in 0.103.10

Incorrect validation of OCSP certificates in TheGreenBow VPN Client Windows Enterprise

• TheGreenBow VPN Client Windows Enterprise
• CWE-299

IBM Cognos Analytics Mobile (iOS) authentication bypass

• IBM Cognos Analytics Mobile
• CWE-299

MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked

• MongoDB Inc MongoDB Server
• CWE-299

notation-go's timestamp signature generation lacks certificate revocation check

• CWE-299

>=1.2.0-beta.1, <1.3.0-rc.2 · fixed in 1.3.0-rc.2

Cloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for Certificate Revocation vulnerability.

• Cloud Mobility for Dell Storage
• CWE-299

Juniper Networks Mist Cloud UI: SAML authentication certificate vulnerability.

• Juniper Networks MIST Cloud UI
• CWE-299

Philips Patient Monitoring Devices Improper Check for Certificate Revocation

• Philips Patient Information Center iX (PICiX)
• Philips PerformanceBridge Focal Point
• CWE-299