CVE-2026-56821

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Exploitation can lead to certificate revocation bypass via replay of an expired OCSP response. Any application using OcspServerCertificateValidator is affected; a revoked certificate can be accepted. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

Published 29 Jul 2026, 00:16 UTC Last modified 29 Jul 2026, 00:16 UTC

7.4

CVSS 3.1 HIGH base score CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack profile

The conditions required to exploit this vulnerability and its potential impact.

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability None

Exploitability2.2

Impact5.2

Affected products

Product applicability statements supplied with the NVD record.

NVD has not published structured affected-product data for this record.

Weakness classification

CWE categories help security teams group the underlying software weakness.

CWECWE-299

Source references

External advisories, patches and technical reports attached to this CVE record.

NVD National Vulnerability Database recordnvd.nist.gov 01 Technical reference security-advisories@github.com