Skip to content
Threat Feed
Subscribe

Product

Netty-Handler-Ssl-Ocsp (>= 4.2.0.Final, < 4.2.16.Final)

1 brief RSS
high advisory

Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

A critical vulnerability (CVE-2026-56820) in Netty's `OcspClient` allows a bad actor to bypass certificate revocation checks by replaying a valid OCSP 'GOOD' status response from an unrelated certificate, enabling a certificate validation bypass for any certificate issued by the same Certificate Authority.

netty-handler-ssl-ocsp +3 netty certificate-validation ocsp vulnerability replay-attack cve tls TOCTOU +1
1c