{"schemaVersion":3,"id":"CVE-2026-56822","aliases":["UBUNTU-CVE-2026-56822","DEBIAN-CVE-2026-56822","CGA-5rfp-vwr7-f6c4","CGA-65wv-43gj-vj56","CGA-969r-ffcg-2pr5","CGA-cc9c-hw8r-jxrc","CGA-cjgx-f54p-8c7r","CGA-hp49-3778-8m2j","CGA-rrw8-j2p6-v7w5","CGA-vh7c-vrcr-6mrj","CGA-w37x-q3rr-m9g8","CGA-wj9g-hggj-f76r","CGA-223c-f63r-q59p","CGA-3v7m-447r-r78c","CGA-48h2-2r4q-38mp","CGA-4h9g-7hwf-47p4","CGA-57hr-f9fj-65hp","CGA-5g4q-mw3v-gfqv","CGA-688p-cf4x-8x57","CGA-729p-772c-hgq3","CGA-73hj-xpxh-94mq","CGA-7rcr-rmcq-m53w","CGA-7v5c-h7jp-2c7j","CGA-7wqq-fjch-84xr","CGA-855f-4389-g5p8","CGA-8h3c-5999-8cpg","CGA-8rh7-r2rh-m958","CGA-953c-v678-w44p","CGA-96mr-96qm-26g6","CGA-998f-h73j-qrm5","CGA-9jf6-9474-9957","CGA-ccqw-6pff-gxcr","CGA-cw7w-6r9m-97hh","CGA-cx2w-pfxp-wv38","CGA-cx57-6x7m-hr3c","CGA-f6c7-2rvx-pgxf","CGA-fpxf-vprw-j89q","CGA-fw9v-58hc-2hh3","CGA-g38q-282w-pc87","CGA-gff4-8fgf-83p5","CGA-hhh2-7792-fqvf","CGA-hp8c-272p-7766","CGA-hqpx-gvqx-c4x6","CGA-hvj8-6g2j-h4h2","CGA-hwr8-jmhw-c2w2","CGA-jwmw-vx83-3cg3","CGA-m474-g52r-ffrp","CGA-mv3w-7526-977h","CGA-mvp5-hx22-fppg","CGA-mx84-5rgw-xrq9","CGA-pj3q-4c43-c4m7","CGA-ppw8-24c9-hqhr","GHSA-wc96-39fc-566f","CGA-q5hr-h46j-54hm","CGA-q7mg-85g5-62wq","CGA-q82w-h7g4-2xm8","CGA-q9f8-6f3m-23rf","CGA-r8fx-fg2q-rmxj","CGA-rjqg-rf8m-4xhr","CGA-rqrj-rjm3-74m3","CGA-vmp6-x9pq-m3g9","CGA-vw33-9cxj-f3fr","CGA-vx56-r8rj-7hf7","CGA-wc5h-fwvr-8h9f","CGA-wgf4-p89p-4x33","CGA-wh5c-9q7g-4279","CGA-wj7c-rmw9-wwrr","CGA-wjrh-rp4v-rgwm","CGA-wq2m-m38h-jrhh","CGA-x238-qgp5-hp6p","CGA-x58c-6872-j8cr"],"status":"published","duplicateOf":null,"title":null,"description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to send sensitive application data (e.g., HTTP requests) to a revoked server before the channel is closed by the OCSP check. n io.netty.handler.ssl.ocsp.OcspServerCertificateValidator#userEventTriggered, when an SslHandshakeCompletionEvent is received, the validator immediately calls ctx.fireUserEventTriggered(evt). It then initiates an asynchronous OCSP query using OcspClient.query. Because the handshake completion event is forwarded immediately, downstream handlers in the client's pipeline are notified that the TLS handshake is successful. They may then begin reading and processing incoming application data or sending outgoing data. If the OCSP response later indicates the server's certificate is REVOKED, the validator closes the channel, but by this time, the client may have already leaked sensitive data to a revoked server or processed malicious responses from it. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.","dates":{"published":"2026-07-28T23:17:17.325Z","modified":"2026-07-30T03:55:17.891Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.4,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.4,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.4,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":5.6,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.4,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":5.6,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":7.4,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":5.6,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.4,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":5.6,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":7.4,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":5.6,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.4,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00173,"percentile":0.06394,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.061000000000000006,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00112},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00112,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00112,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00112,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00112,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00112,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00112,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00112,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00112,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00112,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00112,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00173,"percentile":0.06394}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00112,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00112,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00112,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00112,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00112,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00173,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00173,"percentile":0.06394}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-367","name":"Time-of-check Time-of-use (TOCTOU) Race Condition","description":"The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/367.html"}],"affected":[{"vendor":"chainguard","product":"apache-hop","name":"apache-hop","label":"apache-hop","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-hop","purlType":"apk","versions":[{"text":"< 2.18.1-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.18.1-r7","eol":{"isEol":null,"eolDate":null,"matchMethod":"name_exact","cycle":null,"product":{"name":"apache-hop","label":"Apache Hop","category":"app"}},"hubHref":null},{"vendor":"chainguard","product":"apache-hop-fips","name":"apache-hop-fips","label":"apache-hop-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-hop-fips","purlType":"apk","versions":[{"text":"< 2.18.1-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.18.1-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"cassandra-5.0","name":"cassandra-5.0","label":"cassandra-5.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cassandra-5.0","purlType":"apk","versions":[{"text":"< 5.0.8-r12","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.0.8-r12","eol":null,"hubHref":null},{"vendor":"chainguard","product":"cassandra-fips-5.0","name":"cassandra-fips-5.0","label":"cassandra-fips-5.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cassandra-fips-5.0","purlType":"apk","versions":[{"text":"< 5.0.8-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.0.8-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gremlin-server","name":"gremlin-server","label":"gremlin-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gremlin-server","purlType":"apk","versions":[{"text":"< 3.8.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hadoop-fips-3.3.6","name":"hadoop-fips-3.3.6","label":"hadoop-fips-3.3.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hadoop-fips-3.3.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hadoop-fips-3.4.2","name":"hadoop-fips-3.4.2","label":"hadoop-fips-3.4.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hadoop-fips-3.4.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hadoop-fips-3.5","name":"hadoop-fips-3.5","label":"hadoop-fips-3.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hadoop-fips-3.5","purlType":"apk","versions":[{"text":"< 3.5.0-r3","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 3.5.0-r3 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"management-api-for-apache-cassandra-5.0","name":"management-api-for-apache-cassandra-5.0","label":"management-api-for-apache-cassandra-5.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/management-api-for-apache-cassandra-5.0","purlType":"apk","versions":[{"text":"< 0.1.122-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.1.122-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"pinot","name":"pinot","label":"pinot","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/pinot","purlType":"apk","versions":[{"text":"< 1.5.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"pinot-fips","name":"pinot-fips","label":"pinot-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/pinot-fips","purlType":"apk","versions":[{"text":"< 1.5.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ranger","name":"ranger","label":"ranger","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ranger","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"seata-server","name":"seata-server","label":"seata-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/seata-server","purlType":"apk","versions":[{"text":"< 2.6.0-r22","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.6.0-r22","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tez","name":"tez","label":"tez","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tez","purlType":"apk","versions":[{"text":"< 0.10.5-r21","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.5-r21","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-mqtt-transport","name":"thingsboard-tb-mqtt-transport","label":"thingsboard-tb-mqtt-transport","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-mqtt-transport","purlType":"apk","versions":[{"text":"< 4.3.1.3-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.3-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 4.3.1.3-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.3-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"cassandra-5.0","name":"cassandra-5.0","label":"cassandra-5.0","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/cassandra-5.0","purlType":"apk","versions":[{"text":"< 5.0.8-r12","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.0.8-r12","eol":null,"hubHref":null},{"vendor":"wolfi","product":"management-api-for-apache-cassandra-5.0","name":"management-api-for-apache-cassandra-5.0","label":"management-api-for-apache-cassandra-5.0","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/management-api-for-apache-cassandra-5.0","purlType":"apk","versions":[{"text":"< 0.1.122-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.1.122-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"tez","name":"tez","label":"tez","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/tez","purlType":"apk","versions":[{"text":"< 0.10.5-r21","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.5-r21","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-mqtt-transport","name":"thingsboard-tb-mqtt-transport","label":"thingsboard-tb-mqtt-transport","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-mqtt-transport","purlType":"apk","versions":[{"text":"< 4.3.1.3-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.3-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 4.3.1.3-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.3-r6","eol":null,"hubHref":null},{"vendor":"debian","product":"netty","name":"netty","label":"netty","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/netty","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"netty","name":"netty","label":"netty","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/netty","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"io.netty","product":"netty-handler-ssl-ocsp","name":"io.netty:netty-handler-ssl-ocsp","label":"netty-handler-ssl-ocsp","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/io.netty/netty-handler-ssl-ocsp","purlType":"maven","versions":[{"text":"≥ 4.2.0.Final, < 4.2.16.Final","noFixRecorded":false,"fixedIn":null},{"text":"< 4.1.136.Final","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.2.0.Final, < 4.2.16.Final | < 4.1.136.Final","eol":null,"hubHref":null},{"vendor":"netty","product":"netty","name":"netty","label":"netty","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.2.0.Final, < 4.2.16.Final","noFixRecorded":false,"fixedIn":null},{"text":"< 4.1.136.Final","noFixRecorded":false,"fixedIn":null},{"text":"< 4.1.136","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.2.0, < 4.2.16","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.2.0.Final, < 4.2.16.Final | < 4.1.136.Final | < 4.1.136 | ≥ 4.2.0, < 4.2.16","eol":null,"hubHref":"/vendor/netty/netty"}],"affectedCount":25,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-wc96-39fc-566f","label":"github.com/netty/netty/security/advisories/GHSA-wc96-39fc-566f","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB","Vendor Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-56822","label":"ubuntu.com/security/CVE-2026-56822","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56822","label":"www.cve.org/CVERecord?id=CVE-2026-56822","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56822","label":"security-tracker.debian.org/tracker/CVE-2026-56822","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56822.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56822.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56822","label":"nvd.nist.gov/vuln/detail/CVE-2026-56822","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/netty/netty","label":"github.com/netty/netty","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","label":"github.com/netty/netty/releases/tag/netty-4.1.136.Final","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","label":"github.com/netty/netty/releases/tag/netty-4.2.16.Final","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:11394-1","SUSE-SU-2026:3482-1"],"duplicates":[],"related":["CGA-JCVG-W8GQ-5CVF","OPENSUSE-SU-2026:11394-1","SUSE-SU-2026:3482-1"]},"timeline":[{"kind":"published","date":"2026-07-28T23:17:17.325Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-30T03:55:17.891Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T15:09:22.672Z","stale":false,"partial":false}}