Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.4
CVE-2026-56822: Netty may send data to a revoked server
CVE-2026-56822 · published 3 months ago
Summary
The Netty networking library (versions before 4.1.136.Final and 4.2.16.Final) can report a TLS handshake as successful before it finishes checking the server’s certificate status. This can let a client transmit or receive sensitive information from a server whose certificate has been revoked. Upgrade Netty to the latest versions or apply the provided patches to ensure the certificate check completes before any application data is exchanged.
What to do
- Update netty io.netty:netty-handler-ssl-ocsp to version 4.2.16.Final.
- Update netty io.netty:netty-handler-ssl-ocsp to version 4.1.136.Final.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | netty | io.netty:netty-handler-ssl-ocsp |
>= 4.2.0.Final, < 4.2.16.Final < 4.1.136.Final Fix: upgrade to 4.2.16.Final
|
| – | netty | netty |
>=4.2.0.Final, < 4.2.16.Final >= 4.2.0.Final, < 4.2.16.Final >= 4.1.0, < 4.1.136 >= 4.2.0, < 4.2.16 < 4.1.136 |
| Ubuntu:Pro:14.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:26.04:LTS | canonical | netty | All versions |
| Debian:11 | debian | netty | All versions |
| Debian:12 | debian | netty | All versions |
| Debian:13 | debian | netty | All versions |
| Debian:14 | debian | netty | All versions |
Original advisory text
Netty: TOCTOU in OcspServerCertificateValidator
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to send sensitive application data (e.g., HTTP requests) to a revoked server before the channel is closed by the OCSP check. n io.netty.handler.ssl.ocsp.OcspServerCertificateValidator#userEventTriggered, when an SslHandshakeCompletionEvent is received, the validator immediately calls ctx.fireUserEventTriggered(evt). It then initiates an asynchronous OCSP query using OcspClient.query. Because the handshake completion event is forwarded immediately, downstream handlers in the client's pipeline are notified that the TLS handshake is successful. They may then begin reading and processing incoming application data or sending outgoing data. If the OCSP response later indicates the server's certificate is REVOKED, the validator closes the channel, but by this time, the client may have already leaked sensitive data to a revoked server or processed malicious responses from it. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
References
- https://security-tracker.debian.org/tracker/CVE-2026-56822 Vendor Advisory
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final
- https://github.com/advisories/GHSA-wc96-39fc-566f
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56822... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56822 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-56822 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-56822 Third Party Advisory
- https://github.com/netty/netty/security/advisories/GHSA-wc96-39fc-566f Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition
Timeline
Published29 Jul 2026
Updated26 Oct 2026
First seen22 Jul 2026
Sources
GHSA-wc96-39fc-566f · GHSA
CVE-2026-56822 · NVD
CVE-2026-56822 · MITRE
CVE-2026-56822 · OSV
UBUNTU-CVE-2026-56822 · OSV
DEBIAN-CVE-2026-56822 · OSV
Track software like this
Free during beta