# CVE-2026-56820: Netty OcspClient revocation check bypass via improper CertificateID validation

Source: https://junglewise.ai/threats/cve-2026-56820-netty-ocspclient-revocation-check-bypass-via-improper  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-56820 · Severity: high · CVSS 7.4 · Published 2026-07-21

Netty is a popular networking framework used by many Java applications to handle secure communications. A flaw in its certificate checking component allows an attacker to bypass security checks by reusing a valid status message from a different, unrelated certificate. This could allow a connection using a revoked or fraudulent certificate to be incorrectly trusted, potentially leading to intercepted data or unauthorized access.

Technologies: [io.netty:netty-handler-ssl-ocsp (Maven)](https://junglewise.ai/threats/technologies/io-netty-netty-handler-ssl-ocsp), [Netty Project Netty Handler SSL OCSP](https://junglewise.ai/threats/technologies/netty-handler-ssl-ocsp). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Netty Project](https://junglewise.ai/threats/vendors/netty-project).

## Quick answers

**Is CVE-2026-56820 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56820 being exploited in the wild.

**How severe is CVE-2026-56820?** High severity, with a CVSS score of 7.4, published 21 July 2026.

**Which products and versions are affected?** io.netty:netty-handler-ssl-ocsp (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.16.Final.

**Is there a fix for CVE-2026-56820?** Yes. io.netty:netty-handler-ssl-ocsp (Maven): upgrade to 4.2.16.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56820 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56820?** Check whether you run io.netty:netty-handler-ssl-ocsp (Maven) or Netty Project Netty Handler SSL OCSP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.netty:netty-handler-ssl-ocsp (Maven): upgrade to 4.2.16.Final or later

  ```sh
  # set io.netty:netty-handler-ssl-ocsp to 4.2.16.Final in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability exists in io.netty.handler.ssl.ocsp.OcspClient#validateResponse, which fails to assert that the CertificateID within a returned BasicOCSPResp matches the original certificate being validated. While the client verifies the digital signature of the OCSP response, it ignores the payload's identity field. An attacker with any valid, non-revoked certificate from the same Certificate Authority (CA) can capture a 'GOOD' OCSP response and replay it to satisfy the revocation check for a different, potentially revoked certificate. This violates RFC 6960 requirements for OCSP clients. The issue is patched in versions 4.1.136.Final and 4.2.16.Final.

## Affected products

- Netty netty-handler-ssl-ocsp >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final

## Identifiers

- CVE-2026-56820
- GHSA-272m-gcwp-mpwg

## Timeline

- 2026-07-14: disclosed
- 2026-07-21: advisory: NVD publication
- 2026-07-22: patched: GitHub Advisory reviewed and updated with patch versions

## References

- [https://api.github.com/users/violetagg](https://api.github.com/users/violetagg)
- [https://github.com/violetagg](https://github.com/violetagg)
- [https://api.github.com/users/violetagg/gists%7B/gist_id%7D](https://api.github.com/users/violetagg/gists%7B/gist_id%7D)
- [https://api.github.com/users/violetagg/repos](https://api.github.com/users/violetagg/repos)
- [https://avatars.githubusercontent.com/u/696661?v=4](https://avatars.githubusercontent.com/u/696661?v=4)
- [https://api.github.com/users/violetagg/events%7B/privacy%7D](https://api.github.com/users/violetagg/events%7B/privacy%7D)

## Related threats

- [Netty TOCTOU race condition in OcspServerCertificateValidator](https://junglewise.ai/threats/cve-2026-56822-netty-toctou-race-condition-in-ocspservercertificatevalidator)
- [Netty OcspServerCertificateValidator certificate revocation bypass](https://junglewise.ai/threats/cve-2026-56821-netty-ocspservercertificatevalidator-certificate-revocation)