CVE-2026-86231

The record

A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.

Affected packages

Related vulnerabilities

• CVE-2024-1248 The silent Just-In-Time (JIT) provisioning feature in federated authentication… CWE-298
• CVE-2025-67109 Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5… CWE-298
• CVE-2025-67108 eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket… CWE-298
• CVE-2025-61736 Successful exploitation of this vulnerability could result in the product failing to… CWE-298
• CVE-2026-61699 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. CWE-299
• CVE-2026-56821 Netty is an asynchronous, event-driven network application framework. CWE-299
• CVE-2026-6899 Check for certificate revocation only considers the first matching CRL and ignores other… CWE-299
• CVE-2026-4428 A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes… CWE-299