CVE-2026-56821: 
Java vulnerability analysis and mitigation

CVE-2026-56821 is a certificate revocation bypass vulnerability in Netty's OcspServerCertificateValidator component, classified as "Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator." The flaw allows an on-path attacker to replay a stale OCSP GOOD response to bypass revocation checks for a since-revoked certificate. It affects the Maven package io.netty:netty-handler-ssl-ocsp in versions >= 4.2.0.Final and < 4.2.16.Final, and all versions < 4.1.136.Final. The vulnerability was published by Netty maintainer normanmaurer on July 14, 2026, and added to the GitHub Advisory Database on July 22, 2026. It carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Netty Advisory).

The root cause is classified as CWE-299 (Improper Check for Certificate Revocation). In io.netty.handler.ssl.ocsp.OcspServerCertificateValidator#userEventTriggered, the freshness check fires an exception via ctx.fireExceptionCaught() when an OCSP response is out-of-date, but lacks a return statement — causing execution to fall through and still emit a VALID OcspValidationEvent. Since nonce validation is optional and disabled by default, freshness is the sole replay defense, and it is not enforced. A secondary issue exists where getNextUpdate() may return null, causing current.before(null) to throw a NullPointerException. A proof-of-concept test case demonstrating the bypass (using a 7-day-old OCSP response) is included in the advisory (GitHub Advisory, Netty Advisory).

Successful exploitation allows an on-path unauthenticated attacker to present a revoked TLS certificate that is accepted as valid by any application using OcspServerCertificateValidator. This results in high confidentiality and integrity impact, as the attacker can impersonate a revoked entity to intercept or manipulate encrypted communications. Availability is not directly affected, but the bypass undermines the entire certificate revocation trust model for affected Netty-based applications (GitHub Advisory).

1. Positioning: Attain an on-path network position between the Netty-based client and the OCSP responder (e.g., via ARP spoofing, DNS poisoning, or a rogue network device).
2. Obtain a stale OCSP GOOD response: Capture or generate a previously valid OCSP GOOD response for the target certificate (one that was issued before the certificate was revoked, with thisUpdate and nextUpdate timestamps in the past).
3. Intercept OCSP request: When the Netty client initiates a TLS handshake and queries the OCSP responder for certificate status, intercept the HTTP request to the OCSP endpoint.
4. Replay stale response: Serve the expired OCSP GOOD response (with Content-Type: application/ocsp-response) to the client in place of the legitimate current response.
5. Bypass revocation check: Due to the missing return in the freshness check, OcspServerCertificateValidator fires an exception internally but still emits a VALID OcspValidationEvent, causing the client to accept the revoked certificate as valid.
6. Achieve objective: With the revoked certificate accepted, the attacker can impersonate the certificate holder, enabling man-in-the-middle interception of encrypted traffic or authentication bypass (GitHub Advisory, Netty Advisory).

• Network: Unexpected or duplicate HTTP responses to OCSP endpoint URLs (typically http://<ocsp-responder>/) with Content-Type: application/ocsp-response containing timestamps (thisUpdate, nextUpdate) in the past; OCSP traffic originating from an unexpected IP address rather than the legitimate OCSP responder.
• Logs: Java application logs showing IllegalStateException: OCSP Response is out-of-date followed by a successful TLS handshake completion (indicating the exception was caught but processing continued); absence of connection termination after the OCSP freshness warning.
• Process/Application Behavior: TLS connections succeeding for certificates known to be revoked; OcspValidationEvent with status VALID being fired despite logged OCSP freshness errors in Netty application logs.

Upgrade the io.netty:netty-handler-ssl-ocsp package to the patched versions: 4.2.16.Final (for the 4.2.x branch) or 4.1.136.Final (for the 4.1.x branch) (Netty 4.2.16 Release, Netty 4.1.136 Release). As a defense-in-depth measure prior to patching, consider enabling nonce validation in OcspServerCertificateValidator if supported by your OCSP responder, which adds an additional replay defense. Applications not using OcspServerCertificateValidator are not affected (GitHub Advisory).

The advisory was published by Netty maintainer normanmaurer on July 14, 2026, with credit to reporter violetagg. No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory (Netty Advisory).