Improper Check for Certificate Revocation
CWE-299
The product does not check or incorrectly checks the revocation status of a certificate.
We track 10 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1.
How this weakness is prevented
- Architecture and Design: Ensure that certificates are checked for revoked status.
- Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the revoked status.
Latest Improper Check for Certificate Revocation vulnerabilities
- 8.0 High severity
IntelliJ IDEA: Improper Check for Certificate Revocation
In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3
- 9.4 Critical severity
CPython: Improper Check for Certificate Revocation
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configura
- 7.4 High severity
electron: Improper Check for Certificate Revocation
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js
- 8.1 High severity
nebula-mesh: Improper Check for Certificate Revocation
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a
- 7.4 High severity
netty: Improper Check for Certificate Revocation
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still
- 8.2 High severity
ControlLogix® 5580, CompactLogix® 5380…: Improper Check for Certificate Revocation
A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an inte
- 7.4 High severity
AWS-LC: Improper Check for Certificate Revocation
A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should upg
- 8.2 High severity
TheGreenBow VPN Client Windows Enterprise: Improper Check for Certificate Revocation
Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN client establishes the tunnel even if it does not receive an OCSP response or if the OCSP response sign
- 9.8 Critical severity
MongoDB Server: Improper Check for Certificate Revocation
A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabl
- 7.0 High severity
Cloud Mobility for Dell Storage: Improper Certificate Validation
Cloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for Certificate Revocation vulnerability. A threat actor does not need any specific privileges to potentially exploit this vulnerability. An attacker could perform a man