CVE-2026-56820
io.netty/netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high), Red Hat (high).
Description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| chainguard | apache-hop, apache-hop-fips, cassandra-5.0 and 9 more | 2.18.1-r7 and 10 more |
| debian 11 | netty | no fix listed |
| debian 12 | netty | no fix listed |
| debian 13 | netty | no fix listed |
| debian 14 | netty | no fix listed |
| echo | netty | no fix listed |
| echo maven::Echo OSV | io.netty:netty-handler-ssl-ocsp | 4.1.136.Final |
| maven::GitHub Security Advisory Maven | io.netty:netty-handler-ssl-ocsp | 4.2.16.Final, 4.1.136.Final |
| minimos | apache-hop, apache-hop-fips, datahub-frontend-react and 7 more | 2.19.0-r0 and 4 more |
| rapidfort debian 12 | netty | no fix listed |
| rapidfort debian 13 | netty | no fix listed |
| wolfi | cassandra-5.0, management-api-for-apache-cassandra-5.0, tez and 1 more | 5.0.8-r12 and 3 more |
Show all 35 entries from 12 sources
| Source | Package | Fixed in |
|---|---|---|
| chainguard | apache-hop | 2.18.1-r7 |
| chainguard | apache-hop-fips | 2.18.1-r5 |
| chainguard | cassandra-5.0 | 5.0.8-r12 |
| chainguard | cassandra-fips-5.0 | 5.0.8-r7 |
| chainguard | hadoop-fips-3.5 | 3.5.0-r3 |
| chainguard | management-api-for-apache-cassandra-5.0 | 0.1.122-r2 |
| chainguard | pinot | 1.5.1-r3 |
| chainguard | pinot-fips | 1.5.1-r3 |
| chainguard | seata | 2.6.0-r22 |
| chainguard | tez | 0.10.5-r21 |
| chainguard | thingsboard | 4.3.1.3-r6 |
| chainguard | tinkerpop | 3.8.1-r2 |
| debian 11 | netty | no fix listed |
| debian 12 | netty | no fix listed |
| debian 13 | netty | no fix listed |
| debian 14 | netty | no fix listed |
| echo | netty | no fix listed |
| echo maven::Echo OSV | io.netty:netty-handler-ssl-ocsp | 4.1.136.Final |
| maven::GitHub Security Advisory Maven | io.netty:netty-handler-ssl-ocsp | 4.2.16.Final, 4.1.136.Final |
| minimos | apache-hop | 2.19.0-r0 |
| minimos | apache-hop-fips | 2.19.0-r0 |
| minimos | datahub-frontend-react | 1.7.0-r0 |
| minimos | datahub-frontend-react-fips | 1.7.0-r0 |
| minimos | datahub-upgrade | 1.7.0-r0 |
| minimos | datahub-upgrade-fips | 1.7.0-r0 |
| minimos | management-api-5.0 | 0.1.124-r0 |
| minimos | management-api-fips-5.0 | 0.1.124-r0 |
| minimos | trino | 483-r0 |
| minimos | trino-fips | 483-r2 |
| rapidfort debian 12 | netty | no fix listed |
| rapidfort debian 13 | netty | no fix listed |
| wolfi | cassandra-5.0 | 5.0.8-r12 |
| wolfi | management-api-for-apache-cassandra-5.0 | 0.1.122-r2 |
| wolfi | tez | 0.10.5-r21 |
| wolfi | thingsboard | 4.3.1.3-r6 |
References
- https://access.redhat.com/security/cve/CVE-2026-56820
- https://advisory.echohq.com/cve/CVE-2026-56820
- https://github.com/advisories/GHSA-272m-gcwp-mpwg
- https://github.com/netty/netty
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final