Skip to main content

Netty CVE-2026-56820

CRITICAL
Improper Certificate Validation (CWE-295)
2026-07-21 security-advisories@github.com GHSA-272m-gcwp-mpwg
Authentication Bypass Netty Red Hat
9.1
CVSS 3.1 · NVD
Share

Severity by source

Vendor (github) PRIMARY
HIGH
qualitative
NVD
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
7.4 HIGH

Network-reachable and unauthenticated (AV:N/PR:N/UI:N), but replay needs a same-CA certificate plus an interception position, raising complexity to AC:H; accepting a revoked cert enables impersonation, so C:H/I:H, A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat
7.4 HIGH
qualitative

Primary rating from Vendor (github).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

7
Analysis Updated
Jul 30, 2026 - 15:00 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 14:52 vuln.today
cvss_changed
Severity Changed
Jul 30, 2026 - 14:52 NVD
HIGH CRITICAL
CVSS changed
Jul 30, 2026 - 14:52 NVD
7.4 (HIGH) 9.1 (CRITICAL)
Source Code Evidence Fetched
Jul 22, 2026 - 00:32 vuln.today
Analysis Generated
Jul 22, 2026 - 00:32 vuln.today
CVE Published
Jul 21, 2026 - 23:17 cve.org
HIGH 7.4

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 74 maven packages depend on io.netty:netty-handler-ssl-ocsp (2 direct, 72 indirect)

Ecosystem-wide dependent count for version 4.2.0.Final.

DescriptionNVD

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay attack. OcspClient.validateResponse accepts a legitimately signed GOOD status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

AnalysisAI

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affects versions 4.2.0.Final through 4.2.15.Final and all releases prior to 4.1.136.Final, where OcspClient.validateResponse never confirms that the CertificateID in an OCSP response matches the certificate being validated. An attacker holding any valid, non-revoked certificate from the same issuing CA can obtain a legitimately signed GOOD response and replay it to make Netty accept a revoked or compromised certificate as valid. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain valid same-CA certificate
Delivery
Fetch signed GOOD OCSP response
Exploit
Position as MITM for revoked cert
Execution
Replay GOOD response to Netty client
Persist
CertificateID mismatch ignored
Impact
Revoked certificate accepted as valid
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application uses Netty's OcspClient (netty-handler-ssl-ocsp) to perform OCSP revocation checks, and that the attacker (1) possesses a valid, non-revoked certificate issued by the SAME CA as the certificate being validated and (2) can obtain a legitimately CA-signed GOOD OCSP response for that unrelated certificate. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) rates this critical, but that AC:L likely overstates ease: a successful replay requires the attacker to already possess a valid non-revoked certificate from the same CA AND to be positioned to serve the forged OCSP response to the target (typically a man-in-the-middle or malicious-server role), which is meaningful added complexity - hence my independent assessment lowers complexity to AC:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who legitimately obtains any non-revoked certificate from CA X (e.g., their own domain cert) queries that CA and captures a signed GOOD OCSP response for it. When a Netty-based client later checks the status of a different, revoked certificate also issued by CA X - such as a stolen or compromised server certificate the attacker is presenting during a man-in-the-middle - the attacker returns the captured GOOD response; Netty validates the signature, ignores the mismatched CertificateID, and accepts the revoked certificate. …
Remediation Vendor-released patch: upgrade to Netty 4.1.136.Final (for 4.1.x users) or 4.2.16.Final (for 4.2.x users), which add the missing CertificateID equality check in OcspClient.validateResponse; release notes are at https://github.com/netty/netty/releases/tag/netty-4.1.136.Final and https://github.com/netty/netty/releases/tag/netty-4.2.16.Final and the advisory is GHSA-272m-gcwp-mpwg. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify and document all applications and services in production, development, and testing environments using Netty's SSL/OCSP handler in affected versions (io.netty:netty-handler-ssl-ocsp 4.2.0.Final through 4.2.15.Final, and 4.1.x prior to 4.1.136.Final). …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Netty

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2025-24970 HIGH POC
7.5 Feb 10

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
CVE-2026-59902 HIGH POC
7.5 Aug 17

Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to

CVE-2026-55833 HIGH POC
7.5 Jul 20

Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
CVE-2026-55831 HIGH POC
7.5 Jul 20

Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
CVE-2026-56816 HIGH POC
7.5 Jul 21

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
CVE-2026-48748 HIGH POC
7.5 Jun 12

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
CVE-2026-50011 HIGH POC
7.5 Jun 12

Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remot
CVE-2022-41881 HIGH POC
7.5 Dec 12

Netty project is an event-driven asynchronous network application framework. Rated high severity (CVSS 7.5), this vulner
CVE-2020-7238 HIGH POC
7.5 Jan 27

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Tr
CVE-2019-16869 HIGH POC
7.5 Sep 26

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked
CVE-2025-58057 MEDIUM POC
6.9 Sep 04

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performan

Same weakness CWE-295 – Improper Certificate Validation

View all
CVE-2015-3152 MEDIUM POC
5.9
CVE-2017-2800 CRITICAL POC
9.8
CVE-2014-1266 HIGH POC
7.4
CVE-2022-47758 CRITICAL POC
9.8
CVE-2025-68121 CRITICAL POC
10.0
CVE-2025-29331 CRITICAL POC
9.8
CVE-2025-32878 CRITICAL POC
9.8
CVE-2024-3738 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected

Share

CVE-2026-56820 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy