CVE-2026-56820
io.netty/netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (alta), Red Hat (alta).
Descripción
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| chainguard | apache-hop, apache-hop-fips, cassandra-5.0 y 9 más | 2.18.1-r7 y 10 más |
| debian 11 | netty | sin corrección indicada |
| debian 12 | netty | sin corrección indicada |
| debian 13 | netty | sin corrección indicada |
| debian 14 | netty | sin corrección indicada |
| echo | netty | sin corrección indicada |
| echo maven::Echo OSV | io.netty:netty-handler-ssl-ocsp | 4.1.136.Final |
| maven::GitHub Security Advisory Maven | io.netty:netty-handler-ssl-ocsp | 4.2.16.Final, 4.1.136.Final |
| minimos | apache-hop, apache-hop-fips, datahub-frontend-react y 7 más | 2.19.0-r0 y 4 más |
| rapidfort debian 12 | netty | sin corrección indicada |
| rapidfort debian 13 | netty | sin corrección indicada |
| wolfi | cassandra-5.0, management-api-for-apache-cassandra-5.0, tez y 1 más | 5.0.8-r12 y 3 más |
Mostrar las 35 entradas de 12 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| chainguard | apache-hop | 2.18.1-r7 |
| chainguard | apache-hop-fips | 2.18.1-r5 |
| chainguard | cassandra-5.0 | 5.0.8-r12 |
| chainguard | cassandra-fips-5.0 | 5.0.8-r7 |
| chainguard | hadoop-fips-3.5 | 3.5.0-r3 |
| chainguard | management-api-for-apache-cassandra-5.0 | 0.1.122-r2 |
| chainguard | pinot | 1.5.1-r3 |
| chainguard | pinot-fips | 1.5.1-r3 |
| chainguard | seata | 2.6.0-r22 |
| chainguard | tez | 0.10.5-r21 |
| chainguard | thingsboard | 4.3.1.3-r6 |
| chainguard | tinkerpop | 3.8.1-r2 |
| debian 11 | netty | sin corrección indicada |
| debian 12 | netty | sin corrección indicada |
| debian 13 | netty | sin corrección indicada |
| debian 14 | netty | sin corrección indicada |
| echo | netty | sin corrección indicada |
| echo maven::Echo OSV | io.netty:netty-handler-ssl-ocsp | 4.1.136.Final |
| maven::GitHub Security Advisory Maven | io.netty:netty-handler-ssl-ocsp | 4.2.16.Final, 4.1.136.Final |
| minimos | apache-hop | 2.19.0-r0 |
| minimos | apache-hop-fips | 2.19.0-r0 |
| minimos | datahub-frontend-react | 1.7.0-r0 |
| minimos | datahub-frontend-react-fips | 1.7.0-r0 |
| minimos | datahub-upgrade | 1.7.0-r0 |
| minimos | datahub-upgrade-fips | 1.7.0-r0 |
| minimos | management-api-5.0 | 0.1.124-r0 |
| minimos | management-api-fips-5.0 | 0.1.124-r0 |
| minimos | trino | 483-r0 |
| minimos | trino-fips | 483-r2 |
| rapidfort debian 12 | netty | sin corrección indicada |
| rapidfort debian 13 | netty | sin corrección indicada |
| wolfi | cassandra-5.0 | 5.0.8-r12 |
| wolfi | management-api-for-apache-cassandra-5.0 | 0.1.122-r2 |
| wolfi | tez | 0.10.5-r21 |
| wolfi | thingsboard | 4.3.1.3-r6 |
Referencias
- https://access.redhat.com/security/cve/CVE-2026-56820
- https://advisory.echohq.com/cve/CVE-2026-56820
- https://github.com/advisories/GHSA-272m-gcwp-mpwg
- https://github.com/netty/netty
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final