TOCTOU race condition in Netty OcspServerCertificateValidator (CVE-2026-56822)

Netty's OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent to downstream pipeline handlers before the asynchronous OCSP certificate revocation check completes. This creates a time-of-check to time-of-use (TOCTOU) race window during which client applications may transmit sensitive data to, or process malicious responses from, a server whose certificate is subsequently determined to be revoked. Client applications relying on OcspServerCertificateValidator to enforce certificate revocation are affected. Public POC available. Affected versions: - <=4.2.15.Final - <=4.1.135.Final We recommend updating to: 4.2.16.Final, 4.1.136.Final. CVSS 7.4 · our assessment: this_week Reference: https://github.com/netty/netty/security/advisories/GHSA-wc96-39fc-566f Details: https://vuln.today/cve/CVE-2026-56822