Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

A significant vulnerability, identified as CVE-2026-56820, exists within Netty's OcspClient, specifically in the io.netty.handler.ssl.ocsp.OcspClient#validateResponse method. This flaw stems from a failure to validate that the CertificateID contained within an OCSP response matches the CertificateID of the certificate being requested for validation. This oversight allows an attacker to perform replay attacks: by obtaining a legitimate OCSP "GOOD" status response for any non-revoked certificate issued by a common Certificate Authority (CA), the attacker can then replay this response to a Netty client checking the status of a different certificate. Because the client verifies the response's signature (which is valid as it comes from the CA) but neglects the CertificateID mismatch, it will erroneously accept a potentially revoked or invalid certificate as legitimate. This vulnerability impacts any application using affected Netty versions for OCSP revocation checks, specifically netty-handler-ssl-ocsp in versions from 4.2.0.Final up to 4.2.16.Final (exclusive) and versions prior to 4.1.136.Final.

Attack Chain

1. Identify Target Netty Client: An attacker identifies an application that uses Netty's OcspClient for certificate revocation checks, making it susceptible to validation bypass.
2. Obtain Valid Certificate: The attacker procures a valid, non-revoked certificate that was issued by the same Certificate Authority (CA) as the target certificate intended for bypass.
3. Request Legitimate OCSP Response: The attacker sends a standard OCSP request for this unrelated, valid certificate to the CA's OCSP responder.
4. Capture "GOOD" Status Response: The attacker intercepts and captures the legitimately signed OCSP response, which confirms the "GOOD" status of the unrelated certificate.
5. Intercept Target OCSP Query: When the Netty client attempts to validate the target certificate (which may be revoked or otherwise invalid), the attacker intercepts its outbound OCSP status query.
6. Replay Captured Response: The attacker replies to the Netty client's query by replaying the previously captured "GOOD" status OCSP response (from step 4).
7. Bypass Revocation Check: Due to the vulnerability (CVE-2026-56820), the Netty client accepts the replayed response as valid, failing to detect the CertificateID mismatch, and incorrectly validating the target certificate as non-revoked.
8. Compromise TLS Security: The application proceeds with the connection, unknowingly accepting a potentially revoked or invalid certificate, thereby undermining the security and integrity of TLS/SSL communication.

Impact

This vulnerability leads to a critical certificate validation bypass, potentially allowing applications using Netty's OcspClient to trust revoked or otherwise illegitimate certificates. If exploited, the integrity and authenticity guarantees provided by TLS/SSL can be severely undermined, enabling attackers to impersonate legitimate services or users. Any application that relies on Netty for secure communication, particularly those with OCSP validation enabled, is at risk of accepting fraudulent certificates, which could lead to unauthorized access, data interception, or other forms of compromise without the client detecting the certificate's invalid status.

Recommendation

• Patch CVE-2026-56820 on all affected Netty netty-handler-ssl-ocsp components immediately.
• Upgrade the io.netty:netty-handler-ssl-ocsp library to version 4.2.16.Final or newer, or to 4.1.136.Final or newer, as described in the reference GHSA-272m-gcwp-mpwg.