CVE-2026-56822 Overview
CVE-2026-56822 is a race condition vulnerability in Netty, an asynchronous event-driven network application framework used widely across Java-based servers and clients. The flaw resides in OcspServerCertificateValidator, which forwards the SslHandshakeCompletionEvent before asynchronous Online Certificate Status Protocol (OCSP) validation completes. Downstream pipeline handlers treat the handshake as successful and may transmit sensitive application data to a server whose certificate is later determined to be revoked. Maintainers addressed the issue in versions 4.1.136.Final and 4.2.16.Final. The vulnerability is classified as [CWE-367] Time-of-Check Time-of-Use (TOCTOU).
Critical Impact
Clients may leak sensitive application data such as HTTP requests to a revoked server before the OCSP result closes the channel.
Affected Products
- Netty versions prior to 4.1.136.Final
- Netty versions prior to 4.2.16.Final
- Applications using io.netty.handler.ssl.ocsp.OcspServerCertificateValidator
Discovery Timeline
- 2026-07-29 - CVE-2026-56822 published to the National Vulnerability Database
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-56822
Vulnerability Analysis
The flaw is a TOCTOU race condition in Netty's OCSP client-side certificate validation path. When the TLS handshake completes, OcspServerCertificateValidator#userEventTriggered receives an SslHandshakeCompletionEvent. The validator immediately calls ctx.fireUserEventTriggered(evt), propagating the success signal downstream. It then initiates an asynchronous OCSP query using OcspClient.query to verify the server certificate's revocation status.
Because the event is forwarded before the OCSP verdict returns, downstream handlers assume the peer is trustworthy. Client code may begin reading incoming application data or writing outgoing requests during this window. If the OCSP response later returns REVOKED, the validator closes the channel, but the confidential data has already crossed the wire.
Root Cause
The root cause is ordering: the validator signals handshake completion before completing the revocation check that determines whether the peer should be trusted. This violates the semantics expected by pipeline consumers, which treat the event as authorization to send data.
Attack Vector
An attacker who obtains control of a server whose certificate has been revoked, or who compromises a previously legitimate server after certificate revocation, can receive client data during the OCSP validation window. The attacker may also send crafted responses that downstream handlers process before the channel closes. Exploitation requires an in-path or impersonation position and a revoked but still-usable server certificate. See the Netty GitHub Security Advisory GHSA-wc96-39fc-566f for the maintainers' technical description.
Detection Methods for CVE-2026-56822
Indicators of Compromise
- Outbound TLS sessions to endpoints presenting certificates that later resolve as REVOKED via OCSP or Certificate Revocation Lists (CRLs)
- Application logs showing channel closure by OcspServerCertificateValidator immediately after successful request transmission
- Unexpected connection resets shortly after handshake completion in Netty-based clients
Detection Strategies
- Inventory Java applications that depend on Netty and enumerate versions to identify releases prior to 4.1.136.Final and 4.2.16.Final
- Inspect application pipelines for use of OcspServerCertificateValidator and audit handler ordering
- Correlate egress TLS telemetry with OCSP responder logs to identify sessions where data was sent to revoked certificates
Monitoring Recommendations
- Alert on TLS connections to peers whose certificates fail out-of-band OCSP or CRL checks
- Monitor Netty client logs for SslHandshakeCompletionEvent followed by channel-close events attributed to OCSP validation
- Track dependency manifests such as pom.xml, build.gradle, and shaded JAR contents for vulnerable Netty versions
How to Mitigate CVE-2026-56822
Immediate Actions Required
- Upgrade Netty to 4.1.136.Final or 4.2.16.Final or later
- Rebuild and redeploy applications that shade or bundle Netty within fat JARs or container images
- Review pipeline configurations that use OcspServerCertificateValidator and validate handler ordering after upgrade
Patch Information
The Netty maintainers fixed the issue in versions 4.1.136.Final and 4.2.16.Final. The patched validator defers propagation of the SslHandshakeCompletionEvent until the asynchronous OCSP query completes. Refer to the Netty GitHub Security Advisory GHSA-wc96-39fc-566f for commit references and release notes.
Workarounds
- Perform synchronous OCSP or CRL validation prior to placing sensitive traffic on the channel
- Insert a custom handler that gates downstream propagation of SslHandshakeCompletionEvent until revocation checks resolve
- Enforce OCSP stapling with must-staple certificates at the server side to reduce reliance on client-side asynchronous checks
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
