Security readout for executives and security teams
Plain-English summary
Affected Netty applications may accept a valid “not revoked” response belonging to a different certificate from the same certificate authority. This can undermine certificate revocation checks and allow a revoked certificate to be trusted. Risk is highest where Netty’s OcspClient directly protects sensitive authenticated communications.
Executive priority
Treat this as a high-priority dependency update where Netty OCSP validation protects authentication, confidential traffic, or privileged services. Establish actual OcspClient usage before declaring broad exposure, but do not rely solely on direct dependency inventories. Accelerate remediation for internet-facing or high-value systems; handle unused affected libraries through the normal dependency-update process.
Technical view
Netty OcspClient.validateResponse fails to confirm that an OCSP response’s CertificateID matches the requested certificate. A legitimately signed GOOD response for another certificate from the same CA may therefore satisfy validation. The documented affected ranges are Netty 4.2.0.Final through 4.2.15.Final and versions before 4.1.136.Final. Fixes are in 4.2.16.Final and 4.1.136.Final.
Likely exposure
Exposure requires an affected Netty version and use of OcspClient for certificate revocation decisions. Applications merely containing Netty may not be exploitable. Internet-facing clients or servers handling valuable authenticated sessions warrant faster review, especially when Netty is introduced transitively and dependency versions are not tightly controlled.
Exploitation context
The issue is network-reachable but rated high complexity. Abuse requires a legitimately signed GOOD OCSP response for an unrelated certificate issued by the same CA and an opportunity to replay it during validation. The supplied record is not in KEV, and the provided sources do not report active exploitation.
Researcher notes
CWE-295 applies because the trust decision does not bind the signed OCSP status to the requested certificate. The stated impact is confidentiality and integrity loss without availability impact. The source bundle establishes vulnerable ranges and patched releases, but provides no evidence of exploitation in the wild. Validate reachability and runtime use separately from package presence.
Mitigation direction
- Upgrade Netty 4.1 deployments to 4.1.136.Final or later.
- Upgrade Netty 4.2 deployments to 4.2.16.Final or later.
- Rebuild and redeploy applications containing affected transitive Netty dependencies.
- Prioritize systems relying on OcspClient for sensitive certificate trust decisions.
Validation and detection
- Inventory deployed Netty versions, including resolved transitive dependencies and packaged artifacts.
- Determine whether each affected application invokes OcspClient for revocation checking.
- Verify unrelated CertificateID responses are rejected after upgrading.
- Confirm rebuilt production artifacts contain a fixed Netty version.
- Review monitoring for unexpected certificate validation or revocation behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-295: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-56820 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N2.25.2GitHub_MVulnerability scoring details
Base CVSS 3.1 score
7.4HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwgCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/netty/netty/releases/tag/netty-4.1.136.FinalCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/netty/netty/releases/tag/netty-4.2.16.FinalCVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Certificate Validation
Improper Certificate Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.