Improper Check for Certificate Revocation Affecting com.github.mwiede:jsch package, versions [,2.28.6)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-COMGITHUBMWIEDE-19639692
- published7 Sept 2026
- disclosed7 Sept 2026
- creditYu Bao
Introduced: 7 Sep 2026
NewCVE-2026-86231 (opens in a new tab)How to fix?
Upgrade com.github.mwiede:jsch to version 2.28.6 or higher.
Overview
Affected versions of this package are vulnerable to Improper Check for Certificate Revocation in the known_hosts parser, where HostKey.name2type() lacks OpenSSH certificate-type entries such as ssh-ed25519-cert-v01@openssh.com in its static table, so a @revoked line authored with a certificate-type token fails the lookup and is stored as an UNKNOWN, marker-less entry. An attacker holding a compromised host certificate can pass host verification despite that revocation entry, because UNKNOWN entries are excluded from getHostKey() and never reach OpenSshCertificateUtil.getRevokedKeys(), when the client's known_hosts @revoked line was written with the certificate type string. This requires OpenSSH certificate-based host authentication with StrictHostKeyChecking=yes, and the @revoked entry to have been authored using the certificate-type token rather than the base key type.
Workaround
This vulnerability can be avoided by authoring the @revoked known_hosts entry with the base key type (for example ssh-ed25519) rather than the certificate-type token, so the parser recognizes the type and applies the revocation.