CVE-2026-56820 is a high severity (CVSS 7.4) flaw in Netty's OcspClient. It does not check that an OCSP response matches the certificate that was asked about, so a valid response for another certificate can pass. Upgrade to 4.1.136.Final or 4.2.16.Final.
What's affected
The Netty advisory (GHSA-272m-gcwp-mpwg) lists the Maven package io.netty:netty-handler-ssl-ocsp. Affected: 4.2.15.Final and earlier, and 4.1.135.Final and earlier. Patched: 4.2.16.Final and 4.1.136.Final.
Only applications that call OcspClient to check certificate revocation are affected. Many Netty users never touch this class. Check before you panic, and upgrade as part of routine maintenance if you do not use it.
The record text says "prior to 4.1.135.Final" for the 4.1 line, while the advisory says up to and including 4.1.135.Final. Treat 4.1.135.Final as affected.
How to check if you're exposed
mvn dependency:tree -Dincludes=io.netty
./gradlew dependencies | grep netty
- Look for netty-handler-ssl-ocsp in the tree. If it is not there, OcspClient is not in your build.
- If it is, search your code for OcspClient and OcspClient.query.
- Check fat jars and container images that may hide the dependency.
Run the free in-browser dependency scan at https://gold.safeguard.sh/scan against your manifest or lockfile. It lists vulnerable packages without installing anything.
What to do now
- Upgrade Netty to 4.1.136.Final or 4.2.16.Final.
- Rebuild and redeploy services that use OcspClient.
- If you cannot upgrade yet, add your own check that the certificate ID in each OCSP response matches the one you requested.
- Do not treat a GOOD status from OCSP as the only revocation control for high value certificates.
- Pin Netty versions in dependency management.
Why it matters
The weakness is CWE-295, improper certificate validation. The client verifies the signature of the OCSP response, but does not check that the response is about the certificate it asked about. An attacker who holds any valid certificate from the same authority can obtain a signed GOOD answer for it and replay that answer for another certificate, hiding a revocation.
The vector has high attack complexity and needs no privileges. Signature checks prove who said something, not what they said it about. Always bind a response to its request. The record is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
What does the fix change?
The advisory describes the missing check as the match between the certificate ID in the response and the one requested. The patched releases are 4.1.136.Final and 4.2.16.Final.
Sources
Last reviewed: 19 October 2026.
