CVE-2026-56821

HIGH

Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-56821 has a selected CVSS score of 7.4 (high).

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Exploitation can lead to certificate revocation bypass via replay of an expired OCSP response. Any application using OcspServerCertificateValidator is affected; a revoked certificate can be accepted. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 30, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

netty

Browse netty / netty
CVE List< 4.1.136.Finalaffected
>= 4.2.0.Final, < 4.2.16.Finalaffected

io.netty:netty-handler-ssl-ocsp

Browse Maven / io.netty:netty-handler-ssl-ocsp
GitHub Advisory4.2.0.Final to < 4.2.16.Final · Fixed in 4.2.16.Finalaffected
Before 4.1.136.Final · Fixed in 4.1.136.Finalaffected

References

4