CVE-2026-56822

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final

Description The OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous Online Certificate Status Protocol (OCSP) validation completes. In the userEventTriggered() function, the validator immediately calls ctx.fireUserEventTriggered(evt) upon receiving an SslHandshakeCompletionEvent and then initiates an asynchronous OCSP query using OcspClient.query. This creates a Time-of-Check to Time-of-Use (TOCTOU) condition where downstream handlers are notified that the TLS handshake is successful before the certificate revocation status is confirmed. Consequently, a client may send sensitive application data, such as HTTP requests, to a revoked server or process malicious responses before the channel is closed by the OCSP check.

Recommendations Update to version 4.1.136.Final or later. Update to version 4.2.16.Final or later.