Product
Researchers identified that Java’s certificate blocklist (blocked.certs) can be bypassed for compromised certificates by re-encoding them to produce different SHA-256 fingerprints while maintaining signature validity.