CVE-2026-56821: Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

July 22, 2026

OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate.

References

github.com/advisories/GHSA-g7hg-vrcf-mvmr
github.com/netty/netty/releases/tag/netty-4.1.136.Final
github.com/netty/netty/releases/tag/netty-4.2.16.Final
github.com/netty/netty/security/advisories/GHSA-g7hg-vrcf-mvmr
nvd.nist.gov/vuln/detail/CVE-2026-56821

Code Behaviors & Features

Detect and mitigate CVE-2026-56821 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →