MavenPackage

io.netty:netty-handler-ssl-ocsp

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Version timeline

CVE-2026-56822
Affects 4.1.86.Final to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it)
CVE-2026-56821
Affects 4.1.86.Final to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it)
CVE-2026-56820
Affects 4.1.86.Final to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-56822High 7.4
Netty: TOCTOU in OcspServerCertificateValidator
Affected: from 4.2.0.Final, fixed in 4.2.16.Final; fixed in 4.1.136.Final.
Fixed in 4.1.136.Final (released Jul 8, 2026, 20 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 21 days before disclosure).
The latest release, 4.2.20.Final, is not affected.
CVE-2026-56821High 7.4
Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
Affected: from 4.2.0.Final, fixed in 4.2.16.Final; fixed in 4.1.136.Final.
Fixed in 4.1.136.Final (released Jul 8, 2026, 20 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 21 days before disclosure).
The latest release, 4.2.20.Final, is not affected.
CVE-2026-56820High 7.4
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
Affected: from 4.2.0.Final, fixed in 4.2.16.Final; fixed in 4.1.136.Final.
Fixed in 4.1.136.Final (released Jul 8, 2026, 13 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 14 days before disclosure).
The latest release, 4.2.20.Final, is not affected.