CVE-2026-56822: Netty TOCTOU race condition in OcspServerCertificateValidator

CVE-2026-56822 · Severity: high · CVSS 7.4 · Published 2026-07-29

Netty is a widely used networking framework that helps Java applications communicate over the internet. A security flaw in its certificate validation component allows a client to mistakenly send sensitive data to a server even if that server's security certificate has been revoked. This occurs because the system signals a successful connection before finishing the background check on the certificate's validity, potentially exposing private information to untrusted or compromised servers.

Technologies: io.netty:netty-handler-ssl-ocsp (Maven), Netty Project Netty Handler SSL OCSP. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-56822 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56822 being exploited in the wild.
How severe is CVE-2026-56822?
High severity, with a CVSS score of 7.4, published 29 July 2026.
Which products and versions are affected?
io.netty:netty-handler-ssl-ocsp (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.16.Final; Netty Project Netty Handler SSL OCSP >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final.
Is there a fix for CVE-2026-56822?
Yes. io.netty:netty-handler-ssl-ocsp (Maven): upgrade to 4.2.16.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56822 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-56822?
Check whether you run io.netty:netty-handler-ssl-ocsp (Maven) or Netty Project Netty Handler SSL OCSP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-handler-ssl-ocsp (Maven): upgrade to 4.2.16.Final or later
    # set io.netty:netty-handler-ssl-ocsp to 4.2.16.Final in your pom.xml or build.gradle

Technical details

A time-of-check time-of-use (TOCTOU) vulnerability exists in Netty's OcspServerCertificateValidator. When an SslHandshakeCompletionEvent is received, the validator immediately triggers the event for downstream handlers before the asynchronous OCSP (Online Certificate Status Protocol) query initiated via OcspClient.query completes. This race condition allows downstream handlers to begin sending application data or processing server responses before the certificate's revocation status is confirmed. If the certificate is later found to be revoked, the channel is closed, but sensitive data may have already been leaked. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected products

  • Netty netty-handler-ssl-ocsp < 4.1.136.Final, >= 4.2.0.Final, < 4.2.16.Final

Identifiers

  • CVE-2026-56822
  • GHSA-wc96-39fc-566f

Timeline

  • 2026-07-14: advisory: GitHub Security Advisory published
  • 2026-07-28: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.