CVE-2026-6899

Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper of S2OPC library. It might allow connection between an OPC UA client and server using a revoked certificate.

Score

CVSS 3.1 5.6 Medium

Status

Deferred - cve@gitlab.com

Published

2026-06-09

Last modified

2026-06-09

Weaknesses

CWE-299

Affected products

• S2opc (Systerel)

References

• https://gitlab.com/systerel/S2OPC/-/work_items/1739