Netty CVE-2025-56822: Race Condition in OcsServerCertificateValidator Async OCSP Validation

Vulnerability Overview Vulnerability Name: TOCTOU in OcsServerCertificateValidator CVE ID: CVE-2025-56822 CVSS v3 base metrics: Attack vector: Network Attack complexity: High Privileges required: None User interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None Description: Netty's forwards the before the asynchronous OCSP validation is completed. This allows downstream processors on the client side to send sensitive application data (e.g., HTTP requests) to a revoked server before the OCSP check. Details: In , when a is received, the validator immediately calls . It then initiates an asynchronous OCSP query using . Since the handshake completion event is forwarded immediately, downstream processors in the client pipeline are notified that the TLS handshake was successful and may begin reading and processing incoming application data or sending outgoing data. If the OCSP response later indicates that the server's certificate has been revoked, the validator closes the channel; however, sensitive data may have already been leaked to the revoked server, or malicious responses may have been processed by the client at that point. Affected Versions Affected Versions: - Affected versions: , - Fixed versions: , Impact: Client applications that rely on to enforce server certificate revocation are affected. A malicious server can exploit this vulnerability to successfully establish a TLS connection and receive sensitive application data from the client (or send malicious data to the client) during the window between the completion of the TLS handshake and the failure of the asynchronous OCSP check. Remediation Upgrade to the fixed versions: - version or higher - version or higher POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Netty CVE-2025-56822: Race Condition in OcsServerCertificateValidator Async OCSP Validation

More from this source