Vulnerability in Netty Affecting Asynchronous Network Frameworks

CVE-2026-56822

What is CVE-2026-56822?

An issue exists in the Netty asynchronous network application framework where the OcspServerCertificateValidator improperly handles the SslHandshakeCompletionEvent. This flaw allows the validator to relay the handshake completion event prematurely, enabling downstream handlers to process or transmit sensitive data before the completion of OCSP validation. Should the OCSP query later reveal that the server's certificate is revoked, the channel gets closed, but not before potentially exposing sensitive application data or accepting malicious responses from a compromised server. This vulnerability has been addressed in later versions, emphasizing the critical need for users to upgrade to ensure their implementations maintain robust security.

References