Skip to content
Threat Feed
Subscribe

Tag

Ocsp

1 brief RSS
high advisory

Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

A critical vulnerability (CVE-2026-56820) in Netty's `OcspClient` allows a bad actor to bypass certificate revocation checks by replaying a valid OCSP 'GOOD' status response from an unrelated certificate, enabling a certificate validation bypass for any certificate issued by the same Certificate Authority.

netty-handler-ssl-ocsp +3 netty certificate-validation ocsp vulnerability replay-attack cve tls TOCTOU +1
1c