GHSA-272M-GCWP-MPWG Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

Summary Netty's OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID. A bad actor can replay a GOOD status response issued for an unrelated certificate by the same CA to bypass revocation checks for any certificate. Details...

SUSE CVE-2026-56820

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay...

DEBIAN-CVE-2026-56820

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay...

CVE-2026-56820 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay...

CVE-2026-56820

Netty’s OcspClient vulnerability (CVE-2026-56820) allows a replay attack by not validating the CertificateID in OCSP responses. A forged or unrelated-but-signed OCSP response can be accepted for another certificate issued by the same CA, bypassing revocation checks. Affected versions: 4.2.0.Final...

CVE-2026-56820 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay...

PT-2026-63259

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.135.Final Netty versions 4.2.0.Final through 4.2.15.Final Description The OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to a replay attac...

CERTFR-2026-ACT-024

creationtimestamp| type| source ---|---|--- 2026-06-02 08:18:23+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mnc5u7bels2o 2026-06-08 13:44:39+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mnrsv5au222s...

CERTFR-2025-ACT-054

creationtimestamp| type| source ---|---|--- 2025-12-08 13:34:12+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3m7i5gw5sie23 2025-12-08 13:34:13+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/115684203023191377 2025-12-08 14:44:49+00:00| seen|...

CERTFR-2025-ALE-013

creationtimestamp| type| source ---|---|--- 2025-09-25 17:34:24+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/115266136468526536...

CERTFR-2025-ACT-037

creationtimestamp| type| source ---|---|--- 2025-09-08 12:29:49+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3lyd7fyfmfv2w 2025-09-08 13:25:07+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3lydcirlxmh2p...