Netty: In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response… (CVE-2026-56820)

The vulnerability in Netty's OCSP client arises from the failure to validate that the CertificateID in an OCSP response matches the CertificateID of the certificate being checked. This enables attackers to reuse a valid OCSP response intended for one certificate to falsely validate another revoked certificate issued by the same certificate authority. This undermines the revocation checking mechanism, potentially allowing revoked certificates to be accepted as valid by the client.

An attacker can bypass certificate revocation checks by replaying valid OCSP responses for different certificates issued by the same CA. This can lead to acceptance of revoked certificates, undermining the security guarantees of certificate validation and potentially enabling man-in-the-middle or impersonation attacks where revoked certificates should have been rejected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and consider alternative revocation checking mechanisms or additional validation until a fix is available.