Netflix Lemur up to 1.9.2 Certificate Verification verify.py _validate_revocation_url race condition

Summaryinfo

A vulnerability described as critical has been identified in Netflix Lemur up to 1.9.2. This impacts the function _validate_revocation_url of the file lemur/certificates/verify.py of the component Certificate Verification. Such manipulation leads to race condition. This vulnerability is listed as CVE-2026-70667. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Netflix Lemur up to 1.9.2 and classified as critical. Affected by this issue is the function _validate_revocation_url of the file lemur/certificates/verify.py of the component Certificate Verification. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, so a public attacker-controlled URL could redirect to loopback, RFC1918, link-local, or instance-metadata addresses. Validation and connection also performed separate DNS resolutions, creating a time-of-check time-of-use window for DNS rebinding on both CRL and OCSP paths. An operator uploading a certificate through POST /api/1/certificates/upload could therefore induce blind internal requests despite the earlier mitigation. The fix disables redirects and pins validated addresses while preserving the correct Host value. This issue is fixed in version 1.9.3.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-70667 since 08/04/2026. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 1.9.3 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Netflix

Name

• Lemur

Version

• 1.9.0
• 1.9.1
• 1.9.2

Website

• Product: https://github.com/Netflix/lemur/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion