Replay Attack Vulnerability in Netty Framework
CVE-2026-56820
What is CVE-2026-56820?
The Netty framework is susceptible to a replay attack vulnerability due to insufficient validation of the CertificateID in OCSP responses. Specifically, the OcspClient component fails to ensure that the CertificateID in a status response matches the requested CertificateID, allowing an attacker to exploit this flaw. This deficiency could lead to a situation where bypassing revocation checks is possible, enabling a GOOD status response for a different certificate issued by the same Certificate Authority (CA). The vulnerability affects versions 4.2.0.Final through 4.2.15.Final and 4.1.135.Final and was subsequently resolved in later releases.
Affected Version(s)
netty >= 4.2.0.Final, < 4.2.16.Final < 4.2.0.Final, 4.2.16.Final
netty < 4.1.136.Final < 4.1.136.Final