CVE-2026-56822: Netty: TOCTOU in OcspServerCertificateValidator

July 22, 2026

Netty’s OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client’s downstream handlers to send sensitive application data (e.g., HTTP requests) to a revoked server before the channel is closed by the OCSP check.

References

github.com/advisories/GHSA-wc96-39fc-566f
github.com/netty/netty/releases/tag/netty-4.1.136.Final
github.com/netty/netty/releases/tag/netty-4.2.16.Final
github.com/netty/netty/security/advisories/GHSA-wc96-39fc-566f
nvd.nist.gov/vuln/detail/CVE-2026-56822

Code Behaviors & Features

Detect and mitigate CVE-2026-56822 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →