Is CVE-2026-56821 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56821 being exploited in the wild.

How severe is CVE-2026-56821?

High severity, with a CVSS score of 7.4, published 29 July 2026.

Which products and versions are affected?

io.netty:netty-handler-ssl-ocsp (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.16.Final.

Is there a fix for CVE-2026-56821?

Yes. io.netty:netty-handler-ssl-ocsp (Maven): upgrade to 4.2.16.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56821 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56821?

Check whether you run io.netty:netty-handler-ssl-ocsp (Maven) or Netty Project Netty Handler SSL OCSP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56821: Netty OcspServerCertificateValidator certificate revocation bypass

CVE-2026-56821 · Severity: high · CVSS 7.4 · Published 2026-07-29

Netty is a widely used networking framework for Java applications. A flaw in its certificate validation component allows an attacker to present an expired security status for a certificate that has actually been revoked. This could allow an attacker to impersonate a trusted service or intercept encrypted communications even after their security credentials have been officially cancelled.

Technologies: io.netty:netty-handler-ssl-ocsp (Maven), Netty Project Netty Handler SSL OCSP. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-56821 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56821 being exploited in the wild.
How severe is CVE-2026-56821?: High severity, with a CVSS score of 7.4, published 29 July 2026.
Which products and versions are affected?: io.netty:netty-handler-ssl-ocsp (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.16.Final.
Is there a fix for CVE-2026-56821?: Yes. io.netty:netty-handler-ssl-ocsp (Maven): upgrade to 4.2.16.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56821 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56821?: Check whether you run io.netty:netty-handler-ssl-ocsp (Maven) or Netty Project Netty Handler SSL OCSP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

io.netty:netty-handler-ssl-ocsp (Maven): upgrade to 4.2.16.Final or later

# set io.netty:netty-handler-ssl-ocsp to 4.2.16.Final in your pom.xml or build.gradle

Technical details

A vulnerability exists in the OcspServerCertificateValidator#userEventTriggered method where a freshness check failure does not trigger a return statement. Consequently, even if an IllegalStateException is fired due to an out-of-date response, the execution falls through and emits a VALID OcspValidationEvent. Because nonce validation is disabled by default, an on-path attacker can replay a stale 'GOOD' OCSP response to make a revoked certificate appear valid. Additionally, the component may throw a NullPointerException if the getNextUpdate() field is null. The issue is resolved in versions 4.1.136.Final and 4.2.16.Final.

Affected products

Netty netty-handler-ssl-ocsp < 4.1.136.Final, >= 4.2.0.Final, < 4.2.16.Final

Identifiers

CVE-2026-56821
GHSA-g7hg-vrcf-mvmr

Timeline

2026-07-14: advisory: GitHub advisory published by maintainers
2026-07-28: disclosed: NVD publication date

References

https://github.com/netty/netty/security/advisories/GHSA-g7hg-vrcf-mvmr

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.