CVE-2026-56820: Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
Netty’s OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID. A bad actor can replay a GOOD status response issued for an unrelated certificate (by the same CA) to bypass revocation checks for any certificate.
References
- github.com/advisories/GHSA-272m-gcwp-mpwg
- github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- github.com/netty/netty/releases/tag/netty-4.1.136.Final
- github.com/netty/netty/releases/tag/netty-4.2.16.Final
- github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwg
- nvd.nist.gov/vuln/detail/CVE-2026-56820
Code Behaviors & Features
Detect and mitigate CVE-2026-56820 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →