CVE-2026-56820 PUBLISHED

Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

Assigner: GitHub_M
Reserved: 23.06.2026 Published: 21.07.2026 Updated: 22.07.2026

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay attack. OcspClient.validateResponse accepts a legitimately signed GOOD status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 7.4

Product Status

Vendor netty
Product netty
Versions
  • Version >= 4.2.0.Final, < 4.2.16.Final is affected
  • Version < 4.1.136.Final is affected

References

Problem Types

  • CWE-295: Improper Certificate Validation CWE