ROOT-APP-MAVEN-CVE-2026-42578 CVE-2026-42578 in io.netty:netty-handler-proxy - Patched by Root

Root has patched CVE-2026-42578 in the io.netty:netty-handler-proxy package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-44249 CVE-2026-44249 in io.netty:netty-handler - Patched by Root

Root has patched CVE-2026-44249 in the io.netty:netty-handler package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-50010 CVE-2026-50010 in io.netty:netty-handler - Patched by Root

Root has patched CVE-2026-50010 in the io.netty:netty-handler package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-45416 CVE-2026-45416 in io.netty:netty-handler - Patched by Root

Root has patched CVE-2026-45416 in the io.netty:netty-handler package for Root:Maven. Multiple fixed versions available...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1 for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1 for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.1.8 (RHSA-2026:70228)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70228 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release ...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

io.netty/netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack

A flaw was found in Netty. The OcspClient component fails to validate that the Certificate ID in an Online Certificate Status Protocol OCSP response matches the requested Certificate ID. This vulnerability allows a remote attacker to bypass certificate revocation checks by presenting a legitimate...

CVE-2026-93493

A flaw was found in Netty's netty-handler-ssl-ocsp component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol OCSP response that omits the optional nextUpdate field. This omission causes the OCSP validation to be silently skipped, leading to...

UBUNTU-CVE-2026-93493

A flaw was found in Netty's netty-handler-ssl-ocsp component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol OCSP response that omits the optional nextUpdate field. This omission causes the OCSP validation to be silently skipped, leading to...

Linux Distros Unpatched Vulnerability : CVE-2026-93493

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty's netty-handler-ssl-ocsp component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protoco...

CVE-2026-93578 Io.netty/netty-handler-ssl-ocsp: netty: missing extended key usage (eku) check in ocsp client allows certificate revocation bypass

A flaw was found in Netty's Online Certificate Status Protocol OCSP Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage EKU in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority CA, can exploit this by...

CVE-2026-93578

CVE-2026-93578 affects the Netty library, specifically the netty-handler-ssl-ocsp module. The vulnerability stems from a missing Extended Key Usage (EKU) check in the OCSP client, which allows an attacker to perform a certificate revocation bypass . An OCSP response signed with a certificate lack...

DEBIAN-CVE-2026-93493

A flaw was found in Netty's netty-handler-ssl-ocsp component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol OCSP response that omits the optional nextUpdate field. This omission causes the OCSP validation to be silently skipped, leading to...

CVE-2026-93493

CVE-2026-93493 affects Netty's netty-handler-ssl-ocsp component. The flaw is in OCSP certificate validation: when a remote attacker supplies an OCSP response that omits the optional nextUpdate field, the validation is silently skipped , causing the application to proceed with an unvalidated certi...

EUVD-2026-82770

A flaw was found in Netty's netty-handler-ssl-ocsp component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol OCSP response that omits the optional nextUpdate field. This omission causes the OCSP validation to be silently skipped, leading to...

CVE-2026-93493

A flaw was found in Netty's netty-handler-ssl-ocsp component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol OCSP response that omits the optional nextUpdate field. This omission causes the OCSP validation to be silently skipped, leading to...