CVE-2026-56820 in Netty
Summary
by MITRE • 07/22/2026
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability identified in Netty's OCSP client implementation represents a critical security flaw that undermines the integrity of certificate revocation checking mechanisms. This issue affects versions from 4.2.0.Final through 4.2.15.Final and all prior releases before 4.1.135.Final, creating a significant risk in systems relying on OCSP for certificate validation. The fundamental problem lies in the lack of proper certificate ID matching between the requested certificate and the received OCSP response, which creates an avenue for attackers to exploit the validation process through replay attacks.
The technical flaw manifests in the `OcspClient.validateResponse` method where the implementation fails to verify that the CertificateID present in the OCSP response corresponds to the specific certificate that was originally requested for validation. This oversight allows an attacker to substitute a valid OCSP response for one certificate with a different certificate that shares the same Certification Authority, effectively bypassing the intended revocation checking mechanism. The vulnerability specifically targets the cryptographic validation process where a legitimate GOOD status response from a CA can be reused against unrelated certificates, creating a false sense of security while potentially allowing compromised certificates to remain undetected.
From an operational perspective, this vulnerability creates substantial risks for applications using Netty's network framework for secure communications. Systems relying on OCSP validation for certificate status checking become vulnerable to attacks where revoked certificates might appear valid due to the replay attack vector. The impact extends beyond simple certificate validation failures as it can enable man-in-the-middle attacks, credential theft, and unauthorized access to protected resources that depend on proper certificate authentication. Organizations using affected Netty versions may experience silent security breaches where malicious actors exploit this weakness to maintain access to systems without detection.
The vulnerability aligns with CWE-295 which specifically addresses "Improper Certificate Validation" and relates to ATT&CK technique T1552.001 for "Credentials in Files" as it enables attackers to bypass certificate validation mechanisms that should prevent access through compromised credentials. Security professionals should note that this issue represents a failure in the principle of least privilege where proper certificate binding verification is not enforced during OCSP response processing. The fix implemented in versions 4.1.136.Final and 4.2.16.Final addresses this by enforcing strict matching between requested and received CertificateID values, ensuring that cryptographic responses can only be accepted for the intended certificate.
Organizations should prioritize immediate patching of affected systems to prevent exploitation of this vulnerability, particularly in environments where certificate-based authentication is critical for security. The remediation process involves upgrading to the patched versions while also implementing additional monitoring for suspicious certificate validation patterns. Security teams should conduct thorough assessments of their certificate management practices and consider implementing additional validation layers beyond OCSP to ensure comprehensive protection against similar vulnerabilities that might arise from improper cryptographic protocol implementation.