RHLW-2026-7E27D228834C9346 Lightwell Security Advisory: netty-handler-ssl-ocsp 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-handler-ssl-ocsp 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-56820, CVE-2026-56821, and CVE-2026-56822. CVE-2026-56820: Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVE-2026-56821: Netty: Out-of-date...

CVE-2026-56821: Improper Check for Certificate Revocation

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path...

CVE-2026-56822: Time-of-check Time-of-use (TOCTOU) Race Condition

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to se...

CVE-2026-56822 Netty: TOCTOU in OcspServerCertificateValidator

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to se...

CVE-2026-56822

CVE-2026-56822 affects Netty’s OcspServerCertificateValidator. The TOCTOU race forwards SslHandshakeCompletionEvent before OCSP validation finishes, potentially allowing downstream handlers to send data to a revoked server before the OCSP check closes the channel. Affected releases: prior to 4.1....

CVE-2026-56822

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to se...

EUVD-2026-50090

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path...

CVE-2026-56821

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path...

GHSA-WC96-39FC-566F Netty: TOCTOU in OcspServerCertificateValidator

Summary Netty's OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to send sensitive application data e.g., HTTP requests to a revoked server before the channel is closed by the OC...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview io.netty:netty-handler-ssl-ocsp is a Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Conditio...