{"id":"CVE-2026-56821","aliases":["CLSA-2026-1787045999","CLSA-2026-1787049848","CLSA-2026-1787271464","CLSA-2026-1787301097","CLSA-2026-1787306632","CLSA-2026-1787309634","CLSA-2026-1787331164","CLSA-2026-1787333890","CLSA-2026-1787383378","CLSA-2026-1787397404","DEBIAN-CVE-2026-56821","EUVD-2026-50090","GHSA-g7hg-vrcf-mvmr","GHSA-xpw8-rcwv-8f8p","RHLW-2026-7e27d228834c9346","ROOT-APP-MAVEN-GHSA-xpw8-rcwv-8f8p","SUSE-SU-2026:3482-1","UBUNTU-CVE-2026-56821","openSUSE-SU-2026:11394-1"],"status":"published","title":"Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Exploitation can lead to certificate revocation bypass via replay of an expired OCSP response. Any application using OcspServerCertificateValidator is affected; a revoked certificate can be accepted. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00219,"percentile":0.12523,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-299","CWE-400"],"published":"2023-10-10T22:22:54Z","modified":"2026-11-10T19:58:30Z","fixes":[{"ecosystem":"Maven","package":"io.netty:netty-handler-ssl-ocsp","fixed_in":["4.2.16.Final","4.1.136.Final"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"io.netty:netty-codec-http2","fixed_in":["4.1.100.Final"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"io.root.io.netty:netty-codec-http2","fixed_in":["4.1.97.Final-root.io.1","4.1.97.Final-root.io.2","4.1.97.Final-root.io.3","4.1.97.Final-root.io.4","4.1.97.Final-root.io.5","4.1.97.Final-root.io.6","4.1.97.Final-root.io.7"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.netty:netty-codec-http2","fixed_in":["4.1.97.Final-aikido.7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.Final"},{"fixed":"4.2.16.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.136.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-dev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-microbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-native-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client-runtime-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-shading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-blockhound-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-dev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-microbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-native-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client-runtime-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-shading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-blockhound-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-dev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-microbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-native-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client-runtime-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-shading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-blockhound-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-dev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-microbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-native-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client-runtime-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-shading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-blockhound-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"Debian:12","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16","1:4.1.48-7","1:4.1.48-7+deb12u1","1:4.1.48-7+deb12u2","1:4.1.48-8","1:4.1.48-9"]},{"source":"osv","ecosystem":"Debian:13","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-10+deb13u1","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16"]},{"source":"osv","ecosystem":"Debian:14","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.Final"},{"fixed":"4.2.16.Final"}]}],"versions":["4.2.0.Final","4.2.1.Final","4.2.10.Final","4.2.11.Final","4.2.12.Final","4.2.13.Final","4.2.14.Final","4.2.15.Final","4.2.2.Final","4.2.3.Final","4.2.4.Final","4.2.5.Final","4.2.6.Final","4.2.7.Final","4.2.8.Final","4.2.9.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.136.Final"}]}],"versions":["4.1.100.Final","4.1.101.Final","4.1.102.Final","4.1.103.Final","4.1.104.Final","4.1.105.Final","4.1.106.Final","4.1.107.Final","4.1.108.Final","4.1.109.Final","4.1.110.Final","4.1.111.Final","4.1.112.Final","4.1.113.Final","4.1.114.Final","4.1.115.Final","4.1.116.Final","4.1.117.Final","4.1.118.Final","4.1.119.Final","4.1.120.Final","4.1.121.Final","4.1.122.Final","4.1.123.Final","4.1.124.Final","4.1.125.Final","4.1.126.Final","4.1.127.Final","4.1.128.Final","4.1.129.Final","4.1.130.Final","4.1.131.Final","4.1.132.Final","4.1.133.Final","4.1.134.Final","4.1.135.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final"}]}],"versions":["4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.11.Final","4.1.12.Final","4.1.13.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final-rhlw-00001"}]}],"versions":["4.1.100.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"],"bundled":3},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.97.Final-root.io.1"},{"fixed":"4.1.97.Final-root.io.2"},{"fixed":"4.1.97.Final-root.io.3"},{"fixed":"4.1.97.Final-root.io.4"},{"fixed":"4.1.97.Final-root.io.5"},{"fixed":"4.1.97.Final-root.io.6"},{"fixed":"4.1.97.Final-root.io.7"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.97.Final-aikido.7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.136-150200.4.53.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1","1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:4.0.32-1","1:4.0.33-1","1:4.0.34-1","1:4.0.34-1ubuntu0.1~esm1","1:4.0.34-1ubuntu0.1~esm2","1:4.0.34-1ubuntu0.1~esm3","1:4.0.34-1ubuntu0.1~esm4","1:4.0.34-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.7-4","1:4.1.7-4ubuntu0.1~esm1","1:4.1.7-4ubuntu0.1","1:4.1.7-4ubuntu0.1+esm1","1:4.1.7-4ubuntu0.1+esm2","1:4.1.7-4ubuntu0.1+esm3","1:4.1.7-4ubuntu0.1+esm4","1:4.1.7-4ubuntu0.1+esm5","1:4.1.7-4ubuntu0.1+esm6","1:4.1.7-4ubuntu0.1+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.33-1","1:4.1.33-2","1:4.1.33-3","1:4.1.45-1","1:4.1.45-1ubuntu0.1~esm1","1:4.1.45-1ubuntu0.1~esm2","1:4.1.45-1ubuntu0.1~esm3","1:4.1.45-1ubuntu0.1~esm4","1:4.1.45-1ubuntu0.1~esm6","1:4.1.45-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-4","1:4.1.48-4+deb11u1build0.22.04.1","1:4.1.48-4+deb11u2build0.22.04.1","1:4.1.48-4+deb11u2ubuntu0.1~esm1","1:4.1.48-4+deb11u2ubuntu0.1~esm2","1:4.1.48-4+deb11u2ubuntu0.1","1:4.1.48-4+deb11u2ubuntu0.1+esm1","1:4.1.48-4+deb11u2ubuntu0.1+esm3","1:4.1.48-4+deb11u2ubuntu0.2","1:4.1.48-4+deb11u2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-7","1:4.1.48-8","1:4.1.48-9","1:4.1.48-9ubuntu0.1~esm1","1:4.1.48-9ubuntu0.1~esm2","1:4.1.48-9ubuntu0.1","1:4.1.48-9ubuntu0.1+esm1","1:4.1.48-9ubuntu0.1+esm3","1:4.1.48-9ubuntu0.2","1:4.1.48-9ubuntu0.2+esm1","1:4.1.48-9ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-16","1:4.1.48-16ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-16","1:4.1.48-16ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.136-1.1"}]}],"bundled":19}],"affected_more":270,"products":[{"vendor":"netty","product":"netty"}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-g7hg-vrcf-mvmr","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","tags":["web"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g7hg-vrcf-mvmr","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p","tags":["web"]},{"url":"https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61","tags":["web"]},{"url":"https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44487","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xpw8-rcwv-8f8p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56821.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56821","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56821","tags":["advisory"]},{"url":"https://github.com/netty/netty","tags":["package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56820.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwg","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56820","tags":["advisory"]},{"url":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","tags":["fix"]},{"url":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-272m-gcwp-mpwg","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56822.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-wc96-39fc-566f","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56822","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wc96-39fc-566f","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263482-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271435","tags":["report"]},{"url":"https://bugzilla.suse.com/1271960","tags":["report"]},{"url":"https://bugzilla.suse.com/1271961","tags":["report"]},{"url":"https://bugzilla.suse.com/1272253","tags":["report"]},{"url":"https://bugzilla.suse.com/1272254","tags":["report"]},{"url":"https://bugzilla.suse.com/1272255","tags":["report"]},{"url":"https://bugzilla.suse.com/1272257","tags":["report"]},{"url":"https://bugzilla.suse.com/1272258","tags":["report"]},{"url":"https://bugzilla.suse.com/1272259","tags":["report"]},{"url":"https://bugzilla.suse.com/1272299","tags":["report"]},{"url":"https://bugzilla.suse.com/1272300","tags":["report"]},{"url":"https://bugzilla.suse.com/1272301","tags":["report"]},{"url":"https://bugzilla.suse.com/1272302","tags":["report"]},{"url":"https://bugzilla.suse.com/1272303","tags":["report"]},{"url":"https://bugzilla.suse.com/1272304","tags":["report"]},{"url":"https://bugzilla.suse.com/1272305","tags":["report"]},{"url":"https://bugzilla.suse.com/1272306","tags":["report"]},{"url":"https://bugzilla.suse.com/1272307","tags":["report"]},{"url":"https://bugzilla.suse.com/1272518","tags":["report"]},{"url":"https://bugzilla.suse.com/1272519","tags":["report"]},{"url":"https://bugzilla.suse.com/1272603","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59921","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-56821","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56821","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-56821","title":"Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Exploitation can lead to certificate revocation bypass via replay of an expired OCSP response. Any application using OcspServerCertificateValidator is affected; a revoked certificate can be accepted. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-28T23:07:13.616Z","modified":"2026-07-31T16:12:56.878Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-299"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-50090","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Exploitation can lead to certificate revocation bypass via replay of an expired OCSP response. Any application using OcspServerCertificateValidator is affected; a revoked certificate can be accepted. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-28T23:07:13Z","modified":"2026-07-31T16:12:56Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:02:25.856077Z"}],"ghsa":[{"id":"GHSA-g7hg-vrcf-mvmr","title":"Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator","description":"### Summary\n`OcspServerCertificateValidator` flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as `VALID`, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate.\n\n### Details\nIn `io.netty.handler.ssl.ocsp.OcspServerCertificateValidator#userEventTriggered` the freshness check has no `return`, so execution falls through and a `VALID` `OcspValidationEvent` is still fired:\n\n```java\n if (!(current.after(response.getThisUpdate()) \u0026\u0026\n current.before(response.getNextUpdate()))) {\n ctx.fireExceptionCaught(new IllegalStateException(\"OCSP Response is out-of-date\"));\n }\n```\n\nNonce validation is optional and off by default, so freshness is the only replay defense — and it is not enforced. Additionally `getNextUpdate()` may be `null`, making `current.before(null)` throw `NullPointerException`.\n\nhttps://datatracker.ietf.org/doc/html/rfc6960#section-3.2\n\n```\n 5. The time at which the status being indicated is known to be\n correct (thisUpdate) is sufficiently recent;\n\n 6. When available, the time at or before which newer information will\n be available about the status of the certificate (nextUpdate) is\n greater than the current time.\n```\n\n### PoC\n\nAdd the test below to `io.netty.handler.ssl.ocsp.OcspServerCertificateValidatorTest`\n\n```java\n @Test\n void staleOcspResponseIsRejected() throws Exception {\n X509Bundle caRoot = new CertificateBuilder()\n .algorithm(CertificateBuilder.Algorithm.rsa2048)\n .subject(\"CN=TrustedRootCA\")\n .setIsCertificateAuthority(true)\n .buildSelfSigned();\n\n GeneralName ocspName = new GeneralName(GeneralName.uniformResourceIdentifier, \"http://localhost/\");\n AuthorityInformationAccess aia = new AuthorityInformationAccess(\n new AccessDescription(AccessDescription.id_ad_ocsp, ocspName));\n X509Bundle targetCert = new CertificateBuilder()\n .algorithm(CertificateBuilder.Algorithm.rsa2048)\n .subject(\"CN=TargetServer\")\n .addExtensionOctetString(\"1.3.6.1.5.5.7.1.1\", false, aia.getEncoded())\n .buildIssuedBy(caRoot);\n\n Date past = new Date(System.currentTimeMillis() - TimeUnit.DAYS.toMillis(7));\n CertificateID certId = new CertificateID(\n new JcaDigestCalculatorProviderBuilder().build().get(CertificateID.HASH_SHA1),\n new JcaX509CertificateHolder(caRoot.getCertificate()),\n targetCert.getCertificate().getSerialNumber());\n BasicOCSPRespBuilder respBuilder = new BasicOCSPRespBuilder(\n new RespID(new JcaX509CertificateHolder(caRoot.getCertificate()).getSubject()));\n respBuilder.addResponse(certId, CertificateStatus.GOOD, past, past);\n BasicOCSPResp expiredBasicResp = respBuilder.build(\n new JcaContentSignerBuilder(\"SHA256withRSA\").build(caRoot.getKeyPair().getPrivate()),\n new X509CertificateHolder[0],\n past);\n final byte[] responseEncoded = new OCSPRespBuilder()\n .build(OCSPRespBuilder.SUCCESSFUL, expiredBasicResp).getEncoded();\n\n IoTransport defaultTransport = createDefaultTransport();\n IoTransport mockTransport = IoTransport.create(defaultTransport.eventLoop(), () -\u003e {\n NioSocketChannel channel = new NioSocketChannel();\n channel.pipeline().addFirst(new ChannelOutboundHandlerAdapter() {\n @Override\n public void connect(ChannelHandlerContext ctx, SocketAddress remoteAddress,\n SocketAddress localAddress, ChannelPromise promise) {\n promise.setSuccess();\n ctx.executor().execute(() -\u003e {\n ctx.pipeline().fireChannelActive();\n DefaultFullHttpResponse httpResponse = new DefaultFullHttpResponse(\n HttpVersion.HTTP_1_1, HttpResponseStatus.OK,\n Unpooled.wrappedBuffer(responseEncoded));\n httpResponse.headers().set(HttpHeaderNames.CONTENT_TYPE, \"application/ocsp-response\");\n httpResponse.headers().set(HttpHeaderNames.CONTENT_LENGTH,\n httpResponse.content().readableBytes());\n ctx.pipeline().fireChannelRead(httpResponse);\n });\n }\n });\n return channel;\n }, defaultTransport.datagramChannel());\n\n SslContext serverSslCtx = SslContextBuilder\n .forServer(targetCert.getKeyPair().getPrivate(),\n targetCert.getCertificate(), caRoot.getCertificate())\n .build();\n Channel serverChannel = new ServerBootstrap()\n .group(defaultTransport.eventLoop())\n .channel(NioServerSocketChannel.class)\n .childHandler(new ChannelInitializer\u003cSocketChannel\u003e() {\n @Override\n protected void initChannel(SocketChannel ch) {\n ch.pipeline().addLast(serverSslCtx.newHandler(ch.alloc()));\n }\n })\n .bind(0).sync().channel();\n\n int serverPort = ((InetSocketAddress) serverChannel.localAddress()).getPort();\n\n AtomicBoolean validEventFired = new AtomicBoolean();\n AtomicReference\u003cThrowable\u003e caughtException = new AtomicReference\u003c\u003e();\n CountDownLatch latch = new CountDownLatch(1);\n\n DnsNameResolver resolver = OcspServerCertificateValidator.createDefaultResolver(mockTransport);\n SslContext clientSslCtx = SslContextBuilder.forClient()\n .trustManager(InsecureTrustManagerFactory.INSTANCE)\n .build();\n new Bootstrap()\n .group(defaultTransport.eventLoop())\n .channel(NioSocketChannel.class)\n .handler(new ChannelInitializer\u003cSocketChannel\u003e() {\n @Override\n protected void initChannel(SocketChannel ch) {\n ch.pipeline().addLast(clientSslCtx.newHandler(ch.alloc(), \"127.0.0.1\", serverPort));\n ch.pipeline().addLast(\n new OcspServerCertificateValidator(true, false, mockTransport, resolver));\n ch.pipeline().addLast(new ChannelInboundHandlerAdapter() {\n @Override\n public void userEventTriggered(ChannelHandlerContext ctx, Object evt) {\n if (evt instanceof OcspValidationEvent \u0026\u0026\n ((OcspValidationEvent) evt).response().status() ==\n OcspResponse.Status.VALID) {\n validEventFired.set(true);\n }\n ctx.fireUserEventTriggered(evt);\n }\n\n @Override\n public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) {\n caughtException.compareAndSet(null, cause);\n ctx.channel().close();\n latch.countDown();\n }\n });\n }\n })\n .connect(\"127.0.0.1\", serverPort).sync();\n\n assertTrue(latch.await(5, TimeUnit.SECONDS));\n assertFalse(validEventFired.get(),\n \"OcspValidationEvent(VALID) must not be emitted for a stale OCSP response\");\n assertNotNull(caughtException.get());\n assertInstanceOf(IllegalStateException.class, caughtException.get());\n\n serverChannel.close().sync();\n resolver.close();\n }\n```\n### Impact\nCertificate revocation bypass via replay of an expired OCSP response. Any application using `OcspServerCertificateValidator` is affected; a revoked certificate can be accepted.","status":"published","published":"2026-07-22T21:46:39Z","modified":"2026-07-22T21:46:41Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-299"],"updated_at":"2026-11-02T14:40:51.375752Z"},{"id":"GHSA-xpw8-rcwv-8f8p","title":"io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack","description":"A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack. \n\n### Impact\nThis is a DDOS attack, any http2 server is affected and so you should update as soon as possible.\n\n### Patches\nThis is patched in version 4.1.100.Final.\n\n### Workarounds\nA user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own `Http2FrameListener` implementation or an `ChannelInboundHandler` implementation (depending which http2 API is used).\n\n### References\n- https://www.cve.org/CVERecord?id=CVE-2023-44487\n- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/\n- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/","status":"published","published":"2023-10-10T22:22:54Z","modified":"2023-11-06T22:08:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:15.055009Z"}],"nvd":[{"id":"CVE-2026-56821","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Exploitation can lead to certificate revocation bypass via replay of an expired OCSP response. Any application using OcspServerCertificateValidator is affected; a revoked certificate can be accepted. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-29T00:16:38.573Z","modified":"2026-08-07T15:05:53.92Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-299"],"updated_at":"2026-11-02T14:12:33.629616Z"}],"osv":[{"id":"CVE-2026-56821","title":"Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Exploitation can lead to certificate revocation bypass via replay of an expired OCSP response. Any application using OcspServerCertificateValidator is affected; a revoked certificate can be accepted. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-28T23:07:13.616Z","modified":"2026-10-28T02:31:09.87737993Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-299"],"updated_at":"2026-11-02T15:45:12.016252Z"},{"id":"DEBIAN-CVE-2026-56821","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Exploitation can lead to certificate revocation bypass via replay of an expired OCSP response. Any application using OcspServerCertificateValidator is affected; a revoked certificate can be accepted. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-29T00:16:38.573Z","modified":"2026-10-01T03:03:27.104171043Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"GHSA-g7hg-vrcf-mvmr","title":"Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator","description":"### Summary\n`OcspServerCertificateValidator` flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as `VALID`, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate.\n\n### Details\nIn `io.netty.handler.ssl.ocsp.OcspServerCertificateValidator#userEventTriggered` the freshness check has no `return`, so execution falls through and a `VALID` `OcspValidationEvent` is still fired:\n\n```java\n if (!(current.after(response.getThisUpdate()) \u0026\u0026\n current.before(response.getNextUpdate()))) {\n ctx.fireExceptionCaught(new IllegalStateException(\"OCSP Response is out-of-date\"));\n }\n```\n\nNonce validation is optional and off by default, so freshness is the only replay defense — and it is not enforced. Additionally `getNextUpdate()` may be `null`, making `current.before(null)` throw `NullPointerException`.\n\nhttps://datatracker.ietf.org/doc/html/rfc6960#section-3.2\n\n```\n 5. The time at which the status being indicated is known to be\n correct (thisUpdate) is sufficiently recent;\n\n 6. When available, the time at or before which newer information will\n be available about the status of the certificate (nextUpdate) is\n greater than the current time.\n```\n\n### PoC\n\nAdd the test below to `io.netty.handler.ssl.ocsp.OcspServerCertificateValidatorTest`\n\n```java\n @Test\n void staleOcspResponseIsRejected() throws Exception {\n X509Bundle caRoot = new CertificateBuilder()\n .algorithm(CertificateBuilder.Algorithm.rsa2048)\n .subject(\"CN=TrustedRootCA\")\n .setIsCertificateAuthority(true)\n .buildSelfSigned();\n\n GeneralName ocspName = new GeneralName(GeneralName.uniformResourceIdentifier, \"http://localhost/\");\n AuthorityInformationAccess aia = new AuthorityInformationAccess(\n new AccessDescription(AccessDescription.id_ad_ocsp, ocspName));\n X509Bundle targetCert = new CertificateBuilder()\n .algorithm(CertificateBuilder.Algorithm.rsa2048)\n .subject(\"CN=TargetServer\")\n .addExtensionOctetString(\"1.3.6.1.5.5.7.1.1\", false, aia.getEncoded())\n .buildIssuedBy(caRoot);\n\n Date past = new Date(System.currentTimeMillis() - TimeUnit.DAYS.toMillis(7));\n CertificateID certId = new CertificateID(\n new JcaDigestCalculatorProviderBuilder().build().get(CertificateID.HASH_SHA1),\n new JcaX509CertificateHolder(caRoot.getCertificate()),\n targetCert.getCertificate().getSerialNumber());\n BasicOCSPRespBuilder respBuilder = new BasicOCSPRespBuilder(\n new RespID(new JcaX509CertificateHolder(caRoot.getCertificate()).getSubject()));\n respBuilder.addResponse(certId, CertificateStatus.GOOD, past, past);\n BasicOCSPResp expiredBasicResp = respBuilder.build(\n new JcaContentSignerBuilder(\"SHA256withRSA\").build(caRoot.getKeyPair().getPrivate()),\n new X509CertificateHolder[0],\n past);\n final byte[] responseEncoded = new OCSPRespBuilder()\n .build(OCSPRespBuilder.SUCCESSFUL, expiredBasicResp).getEncoded();\n\n IoTransport defaultTransport = createDefaultTransport();\n IoTransport mockTransport = IoTransport.create(defaultTransport.eventLoop(), () -\u003e {\n NioSocketChannel channel = new NioSocketChannel();\n channel.pipeline().addFirst(new ChannelOutboundHandlerAdapter() {\n @Override\n public void connect(ChannelHandlerContext ctx, SocketAddress remoteAddress,\n SocketAddress localAddress, ChannelPromise promise) {\n promise.setSuccess();\n ctx.executor().execute(() -\u003e {\n ctx.pipeline().fireChannelActive();\n DefaultFullHttpResponse httpResponse = new DefaultFullHttpResponse(\n HttpVersion.HTTP_1_1, HttpResponseStatus.OK,\n Unpooled.wrappedBuffer(responseEncoded));\n httpResponse.headers().set(HttpHeaderNames.CONTENT_TYPE, \"application/ocsp-response\");\n httpResponse.headers().set(HttpHeaderNames.CONTENT_LENGTH,\n httpResponse.content().readableBytes());\n ctx.pipeline().fireChannelRead(httpResponse);\n });\n }\n });\n return channel;\n }, defaultTransport.datagramChannel());\n\n SslContext serverSslCtx = SslContextBuilder\n .forServer(targetCert.getKeyPair().getPrivate(),\n targetCert.getCertificate(), caRoot.getCertificate())\n .build();\n Channel serverChannel = new ServerBootstrap()\n .group(defaultTransport.eventLoop())\n .channel(NioServerSocketChannel.class)\n .childHandler(new ChannelInitializer\u003cSocketChannel\u003e() {\n @Override\n protected void initChannel(SocketChannel ch) {\n ch.pipeline().addLast(serverSslCtx.newHandler(ch.alloc()));\n }\n })\n .bind(0).sync().channel();\n\n int serverPort = ((InetSocketAddress) serverChannel.localAddress()).getPort();\n\n AtomicBoolean validEventFired = new AtomicBoolean();\n AtomicReference\u003cThrowable\u003e caughtException = new AtomicReference\u003c\u003e();\n CountDownLatch latch = new CountDownLatch(1);\n\n DnsNameResolver resolver = OcspServerCertificateValidator.createDefaultResolver(mockTransport);\n SslContext clientSslCtx = SslContextBuilder.forClient()\n .trustManager(InsecureTrustManagerFactory.INSTANCE)\n .build();\n new Bootstrap()\n .group(defaultTransport.eventLoop())\n .channel(NioSocketChannel.class)\n .handler(new ChannelInitializer\u003cSocketChannel\u003e() {\n @Override\n protected void initChannel(SocketChannel ch) {\n ch.pipeline().addLast(clientSslCtx.newHandler(ch.alloc(), \"127.0.0.1\", serverPort));\n ch.pipeline().addLast(\n new OcspServerCertificateValidator(true, false, mockTransport, resolver));\n ch.pipeline().addLast(new ChannelInboundHandlerAdapter() {\n @Override\n public void userEventTriggered(ChannelHandlerContext ctx, Object evt) {\n if (evt instanceof OcspValidationEvent \u0026\u0026\n ((OcspValidationEvent) evt).response().status() ==\n OcspResponse.Status.VALID) {\n validEventFired.set(true);\n }\n ctx.fireUserEventTriggered(evt);\n }\n\n @Override\n public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) {\n caughtException.compareAndSet(null, cause);\n ctx.channel().close();\n latch.countDown();\n }\n });\n }\n })\n .connect(\"127.0.0.1\", serverPort).sync();\n\n assertTrue(latch.await(5, TimeUnit.SECONDS));\n assertFalse(validEventFired.get(),\n \"OcspValidationEvent(VALID) must not be emitted for a stale OCSP response\");\n assertNotNull(caughtException.get());\n assertInstanceOf(IllegalStateException.class, caughtException.get());\n\n serverChannel.close().sync();\n resolver.close();\n }\n```\n### Impact\nCertificate revocation bypass via replay of an expired OCSP response. Any application using `OcspServerCertificateValidator` is affected; a revoked certificate can be accepted.","status":"published","published":"2026-07-22T21:46:39Z","modified":"2026-09-10T03:50:52.144967568Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-299"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"GHSA-xpw8-rcwv-8f8p","title":"io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack","description":"A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack. \n\n### Impact\nThis is a DDOS attack, any http2 server is affected and so you should update as soon as possible.\n\n### Patches\nThis is patched in version 4.1.100.Final.\n\n### Workarounds\nA user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own `Http2FrameListener` implementation or an `ChannelInboundHandler` implementation (depending which http2 API is used).\n\n### References\n- https://www.cve.org/CVERecord?id=CVE-2023-44487\n- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/\n- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/","status":"published","published":"2023-10-10T22:22:54Z","modified":"2026-09-10T03:49:58.76078733Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"RHLW-2026-7e27d228834c9346","title":"Lightwell Security Advisory: netty-handler-ssl-ocsp 4.1.100.Final-rhlw-00001","description":"Red Hat Lightwell has released io.netty:netty-handler-ssl-ocsp 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-56820, CVE-2026-56821, and CVE-2026-56822.\n\nCVE-2026-56820: Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks\n\nCVE-2026-56821: Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator\n\nCVE-2026-56822: Netty: TOCTOU in OcspServerCertificateValidator\n\nThis patched artifact is a drop-in replacement for io.netty:netty-handler-ssl-ocsp 4.1.100.Final from Maven Central.","status":"published","published":"2026-10-12T16:58:21Z","modified":"2026-10-27T04:00:09.766307059Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"ROOT-APP-MAVEN-GHSA-xpw8-rcwv-8f8p","title":"GHSA-xpw8-rcwv-8f8p in io.root.io.netty:netty-codec-http2 - Patched by Root","description":"Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-18T12:52:23Z","modified":"2026-06-18T18:15:26.175069727Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2026-56821","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Exploitation can lead to certificate revocation bypass via replay of an expired OCSP response. Any application using OcspServerCertificateValidator is affected; a revoked certificate can be accepted. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-29T00:16:00Z","modified":"2026-10-17T12:59:10.60078946Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"CLSA-2026-1787045999","title":"TuxCare security update for io.netty (23 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 23 CVEs. Fixed in 4.1.135.Final-tuxcare.1.","status":"published","published":"2026-08-18T09:39:59Z","modified":"2026-10-15T09:46:22.118386744Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787049848","title":"TuxCare security update for io.netty (23 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 23 CVEs. Fixed in 4.1.130.Final-tuxcare.3.","status":"published","published":"2026-08-18T10:44:08Z","modified":"2026-10-15T09:46:35.670728434Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787271464","title":"TuxCare security update for io.netty (59 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.","status":"published","published":"2026-08-21T00:17:44Z","modified":"2026-10-15T09:46:34.75643555Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787301097","title":"TuxCare security update for io.netty (60 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.","status":"published","published":"2026-08-21T08:31:37Z","modified":"2026-10-15T09:46:34.967537233Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787306632","title":"TuxCare security update for io.netty (41 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 41 CVEs. Fixed in 4.1.112.Final-tuxcare.6.","status":"published","published":"2026-08-21T10:03:52Z","modified":"2026-10-15T09:46:35.351743786Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787309634","title":"TuxCare security update for io.netty (62 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.","status":"published","published":"2026-08-21T10:53:54Z","modified":"2026-10-15T09:46:34.370885626Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787331164","title":"TuxCare security update for io.netty (48 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 48 CVEs. Fixed in 4.1.117.Final-tuxcare.3.","status":"published","published":"2026-08-21T16:52:44Z","modified":"2026-10-15T09:47:25.558975504Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787333890","title":"TuxCare security update for io.netty (61 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.","status":"published","published":"2026-08-21T17:38:10Z","modified":"2026-10-15T09:47:25.399673043Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787383378","title":"TuxCare security update for io.netty (61 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.","status":"published","published":"2026-08-22T07:22:58Z","modified":"2026-10-15T09:47:25.582500226Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787397404","title":"TuxCare security update for io.netty (61 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.94.Final-tuxcare.1.","status":"published","published":"2026-08-22T11:16:44Z","modified":"2026-11-10T19:58:30.506519107Z","updated_at":"2026-11-10T20:07:15.512362Z"},{"id":"openSUSE-SU-2026:11394-1","title":"netty-4.1.136-1.1 on GA media","description":"These are all security issues fixed in the netty-4.1.136-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-07-29T18:24:26.986451317Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"SUSE-SU-2026:3482-1","title":"Security update for netty, netty-tcnative","description":"This update for netty, netty-tcnative fixes the following issues:\n\nUpgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final.\n\nSecurity issues fixed\n\n- CVE-2026-44891: memory exhaustion in `io.netty:netty-codec-stomp` (bsc#1271435).\n- CVE-2026-55831: resource exhaustion/DoS in `io.netty:netty-codec-http` (bsc#1271960).\n- CVE-2026-55833: zip bomb in `io.netty:netty-codec-http` (bsc#1271961).\n- CVE-2026-55851: memory exhaustion in `io.netty:netty-codec-haproxy` (bsc#1272253).\n- CVE-2026-56745: memory exhaustion in `io.netty:netty-codec-http` (bsc#1272254).\n- CVE-2026-56746: improper access control in `io.netty:netty-codec-http` (CORS) (bsc#1272255).\n- CVE-2026-56817: insecure defaults in XML parsing in `io.netty:netty-codec-xml` (bsc#1272257).\n- CVE-2026-56818: memory leak in `io.netty:netty-codec-redis` (bsc#1272603).\n- CVE-2026-56819: memory leak in `io.netty:netty-codec-http2` (bsc#1272258).\n- CVE-2026-56820: improper certificate validation in `io.netty:netty-handler-ssl-ocsp` (bsc#1272259).\n- CVE-2026-56821: improper certificate revocation check in `io.netty:netty-handler-ssl-ocsp` (bsc#1272299).\n- CVE-2026-56822: time-of-check/time-of-use in `io.netty:netty-handler-ssl-ocsp` (bsc#1272300).\n- CVE-2026-59898: protocol version confusion in `io.netty:netty-codec-http` (websocket) (bsc#1272302).\n- CVE-2026-59899: memory exhaustion in `io.netty:netty-codec-http` (bsc#1272301).\n- CVE-2026-59900: improper header neutralization in `io.netty:netty-codec-http2` (bsc#1272303).\n- CVE-2026-59901: infinite loop in `io.netty:netty-codec-compression` (bzip2) (bsc#1272304).\n- CVE-2026-59919: improper CR/LF neutralization in `io.netty:netty-codec-haproxy` (bsc#1272305).\n- CVE-2026-59920: improper CR/LF neutrolization in `io.netty:netty-codec-stomp` (bsc#1272306).\n- CVE-2026-59921: improper CR/LF neutralization in `io.netty:netty-codec-http` (multipart) (bsc#1272307).\n- Memory leak in `io.netty:netty-codec-dns` (bsc#1272519).\n- Uncontrolled resource consumption in `io.netty:netty-codec-xml` (bsc#1272518).\n\nOther updates and bugfixes:\n\n- Upgrade to upstream version 4.1.136:\n + SingleThreadEventExecutor: document Throwable safety contract\n on run()\n + Make HTTP/2 frame hashCode consistent with equals\n + Add BlockHound exception for DnsQueryIdSpace (#16896)\n + FlowControlHandler: Fix autoRead behavior\n + Fix incorrect bounds in error message of\n HpackDecoder.setMaxHeaderListSize\n + MQTT: Fix MQTT decoder size check after variable header replay\n + MQTT: Make the decodeProperties early-REPLAY check actually\n fire\n + Reject control characters at the boundary of HTTP method names\n (#16723)\n + Update to latest tcnative release\n + Fix HTTP 2 PUSH_PROMISE stream association validation\n + Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder\n + Add opt-in validation of mandatory pseudo-header fields for\n HTTP/2\n + Strictly validate MQTT UTF-8 Encoded String (#16939)\n + Stop DateFormatter trailing token from running past the parse\n end\n + IpFilter: Deprecate constructor which use accept by default\n + Add RFC 10008 QUERY Method support (#16966)\n + Correctly release and fail queued traffic-shaping writes on\n close (#16959)\n + FlowControlHandler: respect auto-read when toggled while\n dequeueing\n + IdleStateHandler: reset firstWriter/ReaderIdleEvent in\n resetWriteTimeout/resetReadTimeout (#16982)\n + Fix typo in AbstractSniHandler Javadoc\n + Reconcile AbstractCoalescingBufferQueue readableBytes when it\n drains, and fail stuck HTTP/2 streams instead of spinning\n empty DATA frames\n + Reject control characters at the boundary of the HTTP version\n token (#16971)\n + Reset UTF-8 decode state on CR in StompSubframeDecoder\n + HTTP2: Pass the correct number of arguments when logging\n goaway\n + FastLz: Guard decompression against truncated input (#17000)\n + Fix propagation of startTls for client SslContext handler\n + Reject non-token characters in HTTP/2 header names\n + Update lz4-java to 1.11.1\n + Pin github actions to reduce risk (#17043)\n + Merge branches from forks (#17063)\n","status":"published","published":"2026-08-04T11:46:42Z","modified":"2026-08-05T18:23:51.045558593Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}