CVE-2026-56820

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.135.Final Netty versions 4.2.0.Final through 4.2.15.Final

Description The OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to a replay attack. The validateResponse() function accepts a legitimately signed GOOD status response for an unrelated certificate issued by the same CA, allowing the bypass of revocation checks for another certificate.

Recommendations Update to version 4.1.136.Final or later. Update to version 4.2.16.Final or later.