CVE-2026-56821

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final

Description An issue exists in the OcspServerCertificateValidator where out-of-date OCSP (Online Certificate Status Protocol) responses are flagged but not stopped from processing. This allows an on-path attacker to replay a stale GOOD response, causing the system to report it as VALID and bypass the revocation of a certificate. The flaw is located in the userEventTriggered() function of io.netty.handler.ssl.ocsp.OcspServerCertificateValidator, where the freshness check lacks a return statement, allowing execution to fall through and fire a VALID OcspValidationEvent. Additionally, if getNextUpdate() is null, a NullPointerException may occur. OCSP is a protocol used for obtaining the revocation status of an X.509 digital certificate.

Recommendations Update Netty to version 4.1.136.Final or later. Update Netty to version 4.2.16.Final or later. As a temporary mitigation, restrict the use of the OcspServerCertificateValidator component.