Netty: Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the… (CVE-2026-56822)

The vulnerability in Netty's OcspServerCertificateValidator occurs because it forwards the SslHandshakeCompletionEvent before completing asynchronous OCSP validation. This timing issue means that the TLS handshake is considered complete and application data can be exchanged before the server certificate's revocation status is verified. If the certificate is later found to be revoked, the channel is closed, but sensitive data may have already been transmitted or received during the interim. This affects Netty versions prior to 4.1.136.Final and 4.2.16.Final, as well as several specific older versions listed. The CVSS 3.1 score is 7.4 (High impact on confidentiality and integrity, medium attack complexity, no privileges or user interaction required).

Clients may unknowingly send or receive sensitive application data to or from a server whose certificate is revoked, during the time between handshake completion and OCSP validation result. This can lead to exposure of confidential information and compromise of data integrity. The channel is closed only after revocation is detected, so the vulnerability creates a window of exposure.

Upgrade to Netty version 4.1.136.Final or later, or 4.2.16.Final or later, where this timing issue in OCSP validation has been fixed. No other mitigations are indicated. Patch status is confirmed by the version information provided. There is no indication that this affects cloud services or that vendor-managed remediation applies.