High severity7.4NVD Advisory· Published Jul 29, 2026· Updated Aug 7, 2026
CVE-2026-56821
CVE-2026-56821
Description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Exploitation can lead to certificate revocation bypass via replay of an expired OCSP response. Any application using OcspServerCertificateValidator is affected; a revoked certificate can be accepted. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
io.netty:netty-handler-ssl-ocspMaven | >= 4.2.0.Final, < 4.2.16.Final | 4.2.16.Final |
io.netty:netty-handler-ssl-ocspMaven | < 4.1.136.Final | 4.1.136.Final |
Affected products
21- osv-coords18 versionspkg:apk/wolfi/thingsboard-tb-mqtt-transportpkg:rpm/opensuse/netty&distro=openSUSE%20Tumbleweedpkg:apk/chainguard/seata-serverpkg:apk/wolfi/management-api-for-apache-cassandra-5.0pkg:apk/chainguard/cassandra-fips-5.0pkg:apk/chainguard/gremlin-serverpkg:apk/chainguard/pinot-fipspkg:apk/wolfi/tezpkg:apk/chainguard/apache-hoppkg:apk/chainguard/apache-hop-fipspkg:apk/chainguard/cassandra-5.0pkg:apk/chainguard/tezpkg:apk/wolfi/cassandra-5.0pkg:apk/wolfi/thingsboard-tb-nodepkg:apk/chainguard/management-api-for-apache-cassandra-5.0pkg:apk/chainguard/thingsboard-tb-nodepkg:apk/chainguard/pinotpkg:apk/chainguard/thingsboard-tb-mqtt-transport
< 4.3.1.3-r6+ 17 more
- (no CPE)range: < 4.3.1.3-r6
- (no CPE)range: < 4.1.136-1.1
- (no CPE)range: < 2.6.0-r22
- (no CPE)range: < 0.1.122-r2
- (no CPE)range: < 5.0.8-r7
- (no CPE)range: < 3.8.1-r2
- (no CPE)range: < 1.5.1-r3
- (no CPE)range: < 0.10.5-r21
- (no CPE)range: < 2.18.1-r7
- (no CPE)range: < 2.18.1-r5
- (no CPE)range: < 5.0.8-r12
- (no CPE)range: < 0.10.5-r21
- (no CPE)range: < 5.0.8-r12
- (no CPE)range: < 4.3.1.3-r6
- (no CPE)range: < 0.1.122-r2
- (no CPE)range: < 4.3.1.3-r6
- (no CPE)range: < 1.5.1-r3
- (no CPE)range: < 4.3.1.3-r6
Patches
Vulnerability mechanics
References
4- github.com/netty/netty/security/advisories/GHSA-g7hg-vrcf-mvmrnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-g7hg-vrcf-mvmrghsaADVISORY
- github.com/netty/netty/releases/tag/netty-4.1.136.FinalghsaWEB
- github.com/netty/netty/releases/tag/netty-4.2.16.FinalghsaWEB
News mentions
0No linked articles in our index yet.