Detections
Analytics

SCA: security update for io.netty:netty-handler-ssl-ocsp (GHSA-wc96-39fc-566f)

high Tenable Self-Hosted Container Security Plugin ID 445176

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and
 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the
 asynchronous OCSP validation completes. This allows the client's downstream handlers to send sensitive
 application data (e.g., HTTP requests) to a revoked server before the channel is closed by the OCSP check.
 n io.netty.handler.ssl.ocsp.OcspServerCertificateValidator#userEventTriggered, when an
 SslHandshakeCompletionEvent is received, the validator immediately calls ctx.fireUserEventTriggered(evt).
 It then initiates an asynchronous OCSP query using OcspClient.query. Because the handshake completion
 event is forwarded immediately, downstream handlers in the client's pipeline are notified that the TLS
 handshake is successful. They may then begin reading and processing incoming application data or sending
 outgoing data. If the OCSP response later indicates the server's certificate is REVOKED, the validator
 closes the channel, but by this time, the client may have already leaked sensitive data to a revoked
 server or processed malicious responses from it. This issue has been fixed in versions 4.1.136.Final and
 4.2.16.Final. (CVE-2026-56822)

Solution

Update the io.netty:netty-handler-ssl-ocsp library and its related packages to version 4.1.136.Final or later.

See Also

https://github.com/advisories/GHSA-wc96-39fc-566f

Plugin Details

Severity: High

ID: 445176

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 7/23/2026

Updated: 7/29/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.61

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-56822

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/22/2026

Vulnerability Publication Date: 7/22/2026

Reference Information

CVE: CVE-2026-56822

cwe: CWE-367