CVE-2026-56820 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

🗓️ 21 Jul 2026 22:26:16Reported by GoogleType

osv

osv🔗 osv.dev👁 2 Views

Netty OCSP replay flaw from missing CertificateID validation in OcspClient; affects 4.2.0–4.2.15.

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2026-56820	21 Jul 202622:26	–	attackerkb
Circl	CVE-2026-56820	22 Jul 202602:59	–	circl
CVE	CVE-2026-56820	21 Jul 202622:26	–	cve
Cvelist	CVE-2026-56820 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks	21 Jul 202622:26	–	cvelist
EUVD	EUVD-2026-47582	21 Jul 202622:26	–	euvd
NVD	CVE-2026-56820	21 Jul 202623:17	–	nvd
Positive Technologies	PT-2026-63259	21 Jul 202600:00	–	ptsecurity

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56820.json
github	www.github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
github	www.github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
github	www.github.com/netty/netty/releases/tag/netty-4.1.136.Final
github	www.github.com/netty/netty/releases/tag/netty-4.2.16.Final
github	www.github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwg
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-56820

22 Jul 2026 05:32Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.17.4

Netty ocsp flaw OcspClient validation CertificateID mismatch Replay attack risk Affected versions 4.2.0-4.2.15