CVE-2026-56820
io.netty/netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (hoch), Red Hat (hoch).
Beschreibung
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| chainguard | apache-hop, apache-hop-fips, cassandra-5.0 und 9 weitere | 2.18.1-r7 und 10 weitere |
| debian 11 | netty | kein Fix angegeben |
| debian 12 | netty | kein Fix angegeben |
| debian 13 | netty | kein Fix angegeben |
| debian 14 | netty | kein Fix angegeben |
| echo | netty | kein Fix angegeben |
| echo maven::Echo OSV | io.netty:netty-handler-ssl-ocsp | 4.1.136.Final |
| maven::GitHub Security Advisory Maven | io.netty:netty-handler-ssl-ocsp | 4.2.16.Final, 4.1.136.Final |
| minimos | apache-hop, apache-hop-fips, datahub-frontend-react und 7 weitere | 2.19.0-r0 und 4 weitere |
| rapidfort debian 12 | netty | kein Fix angegeben |
| rapidfort debian 13 | netty | kein Fix angegeben |
| wolfi | cassandra-5.0, management-api-for-apache-cassandra-5.0, tez und 1 weitere | 5.0.8-r12 und 3 weitere |
Alle 35 Einträge aus 12 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| chainguard | apache-hop | 2.18.1-r7 |
| chainguard | apache-hop-fips | 2.18.1-r5 |
| chainguard | cassandra-5.0 | 5.0.8-r12 |
| chainguard | cassandra-fips-5.0 | 5.0.8-r7 |
| chainguard | hadoop-fips-3.5 | 3.5.0-r3 |
| chainguard | management-api-for-apache-cassandra-5.0 | 0.1.122-r2 |
| chainguard | pinot | 1.5.1-r3 |
| chainguard | pinot-fips | 1.5.1-r3 |
| chainguard | seata | 2.6.0-r22 |
| chainguard | tez | 0.10.5-r21 |
| chainguard | thingsboard | 4.3.1.3-r6 |
| chainguard | tinkerpop | 3.8.1-r2 |
| debian 11 | netty | kein Fix angegeben |
| debian 12 | netty | kein Fix angegeben |
| debian 13 | netty | kein Fix angegeben |
| debian 14 | netty | kein Fix angegeben |
| echo | netty | kein Fix angegeben |
| echo maven::Echo OSV | io.netty:netty-handler-ssl-ocsp | 4.1.136.Final |
| maven::GitHub Security Advisory Maven | io.netty:netty-handler-ssl-ocsp | 4.2.16.Final, 4.1.136.Final |
| minimos | apache-hop | 2.19.0-r0 |
| minimos | apache-hop-fips | 2.19.0-r0 |
| minimos | datahub-frontend-react | 1.7.0-r0 |
| minimos | datahub-frontend-react-fips | 1.7.0-r0 |
| minimos | datahub-upgrade | 1.7.0-r0 |
| minimos | datahub-upgrade-fips | 1.7.0-r0 |
| minimos | management-api-5.0 | 0.1.124-r0 |
| minimos | management-api-fips-5.0 | 0.1.124-r0 |
| minimos | trino | 483-r0 |
| minimos | trino-fips | 483-r2 |
| rapidfort debian 12 | netty | kein Fix angegeben |
| rapidfort debian 13 | netty | kein Fix angegeben |
| wolfi | cassandra-5.0 | 5.0.8-r12 |
| wolfi | management-api-for-apache-cassandra-5.0 | 0.1.122-r2 |
| wolfi | tez | 0.10.5-r21 |
| wolfi | thingsboard | 4.3.1.3-r6 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2026-56820
- https://advisory.echohq.com/cve/CVE-2026-56820
- https://github.com/advisories/GHSA-272m-gcwp-mpwg
- https://github.com/netty/netty
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final