Vulnerability Description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netty | Netty | < 4.1.136 |
Related Weaknesses (CWE)
References
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bPatch
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6Patch
- https://github.com/netty/netty/releases/tag/netty-4.1.136.FinalRelease Notes
- https://github.com/netty/netty/releases/tag/netty-4.2.16.FinalRelease Notes
- https://github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwgExploitVendor Advisory
FAQ
What is CVE-2026-56820?
CVE-2026-56820 is a vulnerability with a CVSS score of 7.4 (HIGH). Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that t...
How severe is CVE-2026-56820?
CVE-2026-56820 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-56820?
Check the references section above for vendor advisories and patch information. Affected products include: Netty Netty.