CVE-2026-56821
Received Received - Intake

OCSP Response Validation Bypass in Netty

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Exploitation can lead to certificate revocation bypass via replay of an expired OCSP response. Any application using OcspServerCertificateValidator is affected; a revoked certificate can be accepted. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-29
Last Modified
2026-07-29
Generated
2026-07-29
AI Q&A
2026-07-29
EPSS Evaluated
N/A
NVD
CVE-2026-56821

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
netty netty to 4.2.16.Final|end_excluding=4.1.136.Final (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-299 The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Netty's OcspServerCertificateValidator allows an attacker to bypass certificate revocation checks by replaying an expired but still marked as 'GOOD' OCSP response. The validator fails to stop processing after detecting an outdated response, letting revoked certificates be accepted as valid.

Detection Guidance

To detect this vulnerability, check if your Netty application uses versions <=4.2.15.Final or <=4.1.135.Final. Inspect logs for OCSP validation failures or unexpected certificate validations. No specific commands are provided, but monitoring OCSP responses and certificate revocation status is recommended.

Impact Analysis

An attacker could intercept and replay a stale OCSP response to trick systems into accepting a revoked certificate. This could allow unauthorized access to sensitive data or systems, compromising security and confidentiality.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by allowing unauthorized access to personal or health data. Accepting revoked certificates undermines secure authentication and data protection requirements.

Mitigation Strategies

Upgrade Netty to versions 4.1.136.Final or 4.2.16.Final or later. If upgrading is not possible, disable OCSP validation or implement additional certificate revocation checks as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56821. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart