Netty: Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing… (CVE-2026-56821)

CVE-2026-56821 affects the OcspServerCertificateValidator in the io.netty netty-handler-ssl-ocsp component. The validator flags out-of-date OCSP responses but does not stop processing them, allowing replay of stale yet valid OCSP responses. This bypasses revocation checks for certificates that have been revoked. Nonce validation is off by default, reducing protection against replay attacks. The freshness check may also throw exceptions due to null handling issues. The vulnerability affects Netty versions prior to 4.1.136.Final and 4.2.16.Final, with multiple specific affected versions identified. The CVSS 3.1 score is 7.4 (medium severity), reflecting network attack vector, high complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity.

An attacker positioned on the network path can replay stale but previously valid OCSP responses to bypass revocation checks, potentially allowing use of revoked certificates without detection. This undermines the trust model of certificate validation and can lead to unauthorized access or man-in-the-middle attacks. The default off nonce validation further weakens protection against replay attacks. There are no known exploits in the wild at this time.

Upgrade to Netty versions 4.1.136.Final or later, or 4.2.16.Final or later, where this issue is fixed. Since this is a software vulnerability, applying the official fix is the recommended mitigation. No vendor advisory content was provided to indicate alternative mitigations or that no action is required. Patch status is not explicitly confirmed in the input but the presence of fixed versions implies an official fix is available.