CVE-2026-56822
Received Received - Intake

OCSP Validation Bypass in Netty

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to send sensitive application data (e.g., HTTP requests) to a revoked server before the channel is closed by the OCSP check. n io.netty.handler.ssl.ocsp.OcspServerCertificateValidator#userEventTriggered, when an SslHandshakeCompletionEvent is received, the validator immediately calls ctx.fireUserEventTriggered(evt). It then initiates an asynchronous OCSP query using OcspClient.query. Because the handshake completion event is forwarded immediately, downstream handlers in the client's pipeline are notified that the TLS handshake is successful. They may then begin reading and processing incoming application data or sending outgoing data. If the OCSP response later indicates the server's certificate is REVOKED, the validator closes the channel, but by this time, the client may have already leaked sensitive data to a revoked server or processed malicious responses from it. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-29
Last Modified
2026-07-29
Generated
2026-07-29
AI Q&A
2026-07-29
EPSS Evaluated
N/A
NVD
CVE-2026-56822

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
netty netty to 4.2.16.Final (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Time-of-Check Time-of-Use (TOCTOU) issue in Netty's OcspServerCertificateValidator. It occurs because the validator forwards a handshake completion event to downstream handlers before completing asynchronous OCSP certificate validation. This creates a race condition where clients may send sensitive data to a server with a revoked certificate before the channel is closed.

Detection Guidance

Detecting this vulnerability requires checking the Netty version in use. Inspect application dependencies or server logs for Netty versions before 4.1.136.Final or 4.2.16.Final. Commands like 'mvn dependency:tree' for Maven or 'gradle dependencies' for Gradle can help identify the version.

Impact Analysis

This vulnerability allows a malicious server with a revoked certificate to receive sensitive application data from the client or send malicious data during the window between TLS handshake completion and OCSP validation failure. It could lead to data leaks or unauthorized data transmission.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, which may violate GDPR's data protection principles and HIPAA's safeguards for protected health information. The exposure of sensitive data to revoked servers could result in non-compliance with these regulations due to potential breaches of confidentiality and integrity.

Mitigation Strategies

Upgrade Netty to version 4.1.136.Final or later for the 4.1.x branch, or 4.2.16.Final or later for the 4.2.x branch. This resolves the TOCTOU issue by ensuring OCSP validation completes before forwarding handshake events.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56822. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart