by Kastro
Paper/Archive/CVE-2026-56820

CVE-2026-56820

netty netty — Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

EPSS 0.3%public exploitCVSS 9.1
critical.is priorityof 100
42
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 24.2.242 × 204.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected

ProductAffectedFixed inSource
netty>= 4.2.0.Final, < 4.2.16.Final–CNA
netty< 4.1.136.Final–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_M (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwgrefgithub.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003brefgithub.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6refgithub.com/netty/netty/releases/tag/netty-4.1.136.Finalrefgithub.com/netty/netty/releases/tag/netty-4.2.16.Final