Certificate Revocation Bypass Vulnerability in Netty Framework
CVE-2026-56821

7.4HIGH

Key Information:

Vendor

Netty

Status
Netty
Vendor
CVE Published:
28 July 2026

What is CVE-2026-56821?

The Netty framework, widely used for asynchronous network application development, contains a vulnerability in its OcspServerCertificateValidator component. Prior to specific versions, the validator improperly flags outdated OCSP responses without halting their processing. This oversight permits a malicious actor to replay an expired 'GOOD' OCSP response, which can mislead applications to erroneously accept a previously revoked certificate. Users of the affected versions should update to Netty 4.1.136.Final or 4.2.16.Final to mitigate this risk and secure their applications against potential certificate validation issues.

Affected Version(s)

netty < 4.1.136.Final < 4.1.136.Final

netty >=4.2.0.Final, < 4.2.16.Final < 4.2.0.Final, 4.2.16.Final

References

https://github.com/netty/netty/security/advisories/GHSA-g...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.