← CVE Radar
CVE-2026-56820Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
9.1 CRITICALEPSS 0.31%Not in KEVNVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.1 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 7.4 | HIGH | 3.1GitHub_M (CNA) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Details
- CVE ID
- CVE-2026-56820
- Status
- Analyzed
- Assigner (CNA)
- GitHub_M
- Published
- Jul 21, 2026
- Last modified
- 2026-07-30 14:48 UTC
- Weaknesses
- CWE-295 · Improper Certificate Validation
Affected Products
As published by the CNA in the CVE record.
nettynetty2 version ranges
- >= 4.2.0.Final, < 4.2.16.Final
- < 4.1.136.Final
References
- github.com https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- github.com https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- github.com https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
- github.com https://github.com/netty/netty/releases/tag/netty-4.2.16.Final
- github.com https://github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwg