CVE-2026-56822 netty CVE debrief

Who should care

Users of Netty versions prior to 4.1.136.Final and 4.2.16.Final should be aware of this vulnerability and take defensive actions to prevent sensitive application data from being leaked to a revoked server. This includes updating Netty to version 4.1.136.Final or 4.2.16.Final, implementing compensating controls to monitor and block sensitive data, conducting inventory checks to identify affected systems, and verifying vendor remediation and applying patches. Operators, platform administrators, vulnerability management teams, and security teams should review the affected scope, severity, and vendor guidance to determine the necessary actions to address this vulnerability.

Technical summary

The OcspServerCertificateValidator in Netty versions prior to 4.1.136.Final and 4.2.16.Final forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows downstream handlers to send sensitive application data to a revoked server before the channel is closed by the OCSP check. The vulnerability is caused by the immediate forwarding of the SslHandshakeCompletionEvent, which allows downstream handlers to send sensitive application data to a revoked server before the OCSP response indicates the server's certificate is REVOKED.

Defensive priority

High-priority defensive actions are required to address this vulnerability, as it allows sensitive application data to be leaked to a revoked server before the channel is closed by the OCSP check.

Recommended defensive actions

• Update Netty to version 4.1.136.Final or 4.2.16.Final
• Implement compensating controls to monitor and block sensitive data
• Conduct inventory checks to identify affected systems
• Verify vendor remediation and apply patches
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record indicates that Netty versions prior to 4.1.136.Final and 4.2.16.Final are vulnerable to this issue. The OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes, allowing downstream handlers to send sensitive application data to a revoked server.

Official resources