Log in Start free

Vulnerability · Published Jul 21, 2026 · Assigned by GitHub_M

CVE-2026-56820Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

High 7.4

In plain English

A high-severity improper certificate validation in netty from netty. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.3%top 75.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nettyno fix listedDEBIAN-CVE-2026-56820
Debian:13nettyno fix listedDEBIAN-CVE-2026-56820
Debian:14nettyno fix listedDEBIAN-CVE-2026-56820
Mavenio.netty:netty-handler-ssl-ocsp4.2.16.FinalGHSA-272m-gcwp-mpwg
Mavenio.netty:netty-handler-ssl-ocsp4.1.136.FinalGHSA-272m-gcwp-mpwg
Ubuntu:26.10nettyno fix listedUBUNTU-CVE-2026-56820

Affected products (as reported)

VendorProductVersions
netty netty >= 4.2.0.Final, < 4.2.16.Final< 4.1.136.Final

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References