Description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to send sensitive application data (e.g., HTTP requests) to a revoked server before the channel is closed by the OCSP check. n io.netty.handler.ssl.ocsp.OcspServerCertificateValidator#userEventTriggered, when an SslHandshakeCompletionEvent is received, the validator immediately calls ctx.fireUserEventTriggered(evt). It then initiates an asynchronous OCSP query using OcspClient.query. Because the handshake completion event is forwarded immediately, downstream handlers in the client's pipeline are notified that the TLS handshake is successful. They may then begin reading and processing incoming application data or sending outgoing data. If the OCSP response later indicates the server's certificate is REVOKED, the validator closes the channel, but by this time, the client may have already leaked sensitive data to a revoked server or processed malicious responses from it. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| netty | netty | affected |
|
No data.
No data.
No data available yet.
Remediation
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-wc96-39fc-566f | Netty: TOCTOU in OcspServerCertificateValidator |
References
History
Tue, 28 Jul 2026 23:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in Netty's `netty-handler-ssl-ocsp` component. This vulnerability involves a time-of-check/time-of-use (TOCTOU) race condition within the OCSP stapling validator. A remote attacker could exploit this timing window, allowing them to use a certificate that has been revoked for authentication purposes. This could lead to unauthorized access or bypass of security controls. | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to send sensitive application data (e.g., HTTP requests) to a revoked server before the channel is closed by the OCSP check. n io.netty.handler.ssl.ocsp.OcspServerCertificateValidator#userEventTriggered, when an SslHandshakeCompletionEvent is received, the validator immediately calls ctx.fireUserEventTriggered(evt). It then initiates an asynchronous OCSP query using OcspClient.query. Because the handshake completion event is forwarded immediately, downstream handlers in the client's pipeline are notified that the TLS handshake is successful. They may then begin reading and processing incoming application data or sending outgoing data. If the OCSP response later indicates the server's certificate is REVOKED, the validator closes the channel, but by this time, the client may have already leaked sensitive data to a revoked server or processed malicious responses from it. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final. |
| Title | io.netty/netty-handler-ssl-ocsp: Netty: Time-of-check/time-of-use in netty-handler-ssl-ocsp | Netty: TOCTOU in OcspServerCertificateValidator |
Tue, 28 Jul 2026 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in Netty's `netty-handler-ssl-ocsp` component. This vulnerability involves a time-of-check/time-of-use (TOCTOU) race condition within the OCSP stapling validator. A remote attacker could exploit this timing window, allowing them to use a certificate that has been revoked for authentication purposes. This could lead to unauthorized access or bypass of security controls. | |
| Title | io.netty/netty-handler-ssl-ocsp: Netty: Time-of-check/time-of-use in netty-handler-ssl-ocsp | |
| Weaknesses | CWE-367 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-07-28T23:17:17.325Z
Reserved: 2026-06-23T14:55:09.116Z
Link: CVE-2026-56822
Vulnrichment
No data.
NVD
No data.
Redhat
OpenCVE Enrichment
No data.
Weaknesses
-
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition