{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/netty-handler-ssl-ocsp-versions-4.2.x-prior-to-4.2.16.final/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-56820"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["netty-handler-ssl-ocsp (versions 4.2.x prior to 4.2.16.Final)","netty-handler-ssl-ocsp (versions 4.1.x prior to 4.1.136.Final)","netty-handler-ssl-ocsp (\u003e= 4.2.0.Final, \u003c 4.2.16.Final)","netty-handler-ssl-ocsp (\u003c 4.1.136.Final)"],"_cs_severities":["high"],"_cs_tags":["netty","certificate-validation","ocsp","vulnerability","replay-attack","cve","tls","TOCTOU","data-leakage"],"_cs_type":"advisory","_cs_vendors":["Netty"],"content_html":"\u003cp\u003eA significant vulnerability, identified as CVE-2026-56820, exists within Netty's \u003ccode\u003eOcspClient\u003c/code\u003e, specifically in the \u003ccode\u003eio.netty.handler.ssl.ocsp.OcspClient#validateResponse\u003c/code\u003e method. This flaw stems from a failure to validate that the \u003ccode\u003eCertificateID\u003c/code\u003e contained within an OCSP response matches the \u003ccode\u003eCertificateID\u003c/code\u003e of the certificate being requested for validation. This oversight allows an attacker to perform replay attacks: by obtaining a legitimate OCSP \u0026quot;GOOD\u0026quot; status response for any non-revoked certificate issued by a common Certificate Authority (CA), the attacker can then replay this response to a Netty client checking the status of a \u003cem\u003edifferent\u003c/em\u003e certificate. Because the client verifies the response's signature (which is valid as it comes from the CA) but neglects the CertificateID mismatch, it will erroneously accept a potentially revoked or invalid certificate as legitimate. This vulnerability impacts any application using affected Netty versions for OCSP revocation checks, specifically \u003ccode\u003enetty-handler-ssl-ocsp\u003c/code\u003e in versions from 4.2.0.Final up to 4.2.16.Final (exclusive) and versions prior to 4.1.136.Final.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eIdentify Target Netty Client\u003c/strong\u003e: An attacker identifies an application that uses Netty's \u003ccode\u003eOcspClient\u003c/code\u003e for certificate revocation checks, making it susceptible to validation bypass.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eObtain Valid Certificate\u003c/strong\u003e: The attacker procures a valid, non-revoked certificate that was issued by the same Certificate Authority (CA) as the target certificate intended for bypass.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRequest Legitimate OCSP Response\u003c/strong\u003e: The attacker sends a standard OCSP request for this \u003cem\u003eunrelated\u003c/em\u003e, valid certificate to the CA's OCSP responder.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCapture \u0026quot;GOOD\u0026quot; Status Response\u003c/strong\u003e: The attacker intercepts and captures the legitimately signed OCSP response, which confirms the \u0026quot;GOOD\u0026quot; status of the unrelated certificate.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eIntercept Target OCSP Query\u003c/strong\u003e: When the Netty client attempts to validate the \u003cem\u003etarget\u003c/em\u003e certificate (which may be revoked or otherwise invalid), the attacker intercepts its outbound OCSP status query.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReplay Captured Response\u003c/strong\u003e: The attacker replies to the Netty client's query by replaying the previously captured \u0026quot;GOOD\u0026quot; status OCSP response (from step 4).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eBypass Revocation Check\u003c/strong\u003e: Due to the vulnerability (CVE-2026-56820), the Netty client accepts the replayed response as valid, failing to detect the \u003ccode\u003eCertificateID\u003c/code\u003e mismatch, and incorrectly validating the target certificate as non-revoked.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCompromise TLS Security\u003c/strong\u003e: The application proceeds with the connection, unknowingly accepting a potentially revoked or invalid certificate, thereby undermining the security and integrity of TLS/SSL communication.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability leads to a critical certificate validation bypass, potentially allowing applications using Netty's OcspClient to trust revoked or otherwise illegitimate certificates. If exploited, the integrity and authenticity guarantees provided by TLS/SSL can be severely undermined, enabling attackers to impersonate legitimate services or users. Any application that relies on Netty for secure communication, particularly those with OCSP validation enabled, is at risk of accepting fraudulent certificates, which could lead to unauthorized access, data interception, or other forms of compromise without the client detecting the certificate's invalid status.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-56820 on all affected Netty \u003ccode\u003enetty-handler-ssl-ocsp\u003c/code\u003e components immediately.\u003c/li\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003eio.netty:netty-handler-ssl-ocsp\u003c/code\u003e library to version \u003ccode\u003e4.2.16.Final\u003c/code\u003e or newer, or to \u003ccode\u003e4.1.136.Final\u003c/code\u003e or newer, as described in the reference GHSA-272m-gcwp-mpwg.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T21:50:01Z","date_published":"2026-07-22T21:46:23Z","id":"https://feed.craftedsignal.io/briefs/2026-07-netty-ocsp-replay-cve-2026-56820/","summary":"A critical vulnerability (CVE-2026-56820) in Netty's `OcspClient` allows a bad actor to bypass certificate revocation checks by replaying a valid OCSP 'GOOD' status response from an unrelated certificate, enabling a certificate validation bypass for any certificate issued by the same Certificate Authority.","title":"Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks","url":"https://feed.craftedsignal.io/briefs/2026-07-netty-ocsp-replay-cve-2026-56820/"}],"language":"en","title":"CraftedSignal Threat Feed - Netty-Handler-Ssl-Ocsp (Versions 4.2.x Prior to 4.2.16.Final)","version":"https://jsonfeed.org/version/1.1"}