# Netty: TOCTOU in OcspServerCertificateValidator

Netty's OcspServerCertificateValidator fires SslHandshakeCompletionEvent before async OCSP check finishes, letting revoked servers receive client data.

- Payout: Research
- Severity: high
- Program: Netty
- Found by: violetagg
- Disclosed: 2026-07-22
- CVE: CVE-2026-56822
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-wc96-39fc-566f
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-wc96-39fc-566f
- Tags: area:oss domain:oss impact:data-leak kind:research platform:ghsa sev:high tech:java technique:race-window technique:source-review vuln:auth-bypass vuln:race-condition

**Target:** TLS client pipeline handler (netty-handler-ssl-ocsp)
**Root cause:** userEventTriggered forwards SslHandshakeCompletionEvent to downstream handlers immediately, then starts the asynchronous OcspClient.query; the channel is only closed after the OCSP response returns REVOKED.
**Steps:**
1. Build a server cert with AIA OCSP extension pointing at an attacker-controlled URL and a revoked status.
2. Client pipeline: ssl handler, then `OcspServerCertificateValidator`, then a handler that writes application data on `SslHandshakeCompletionEvent.isSuccess()`.
3. Mock the OCSP transport to return an OCSP response (e.g. INTERNAL_ERROR/REVOKED) after a delay.
4. Observe the client writes `SECRET_DATA` to the server before the validator closes the channel.
**How found:** Code review of the validator's event ordering: noticing fireUserEventTriggered precedes the async OCSP query, so downstream handlers act on unvalidated handshake success.
**Exploitation:** A malicious server presenting a revoked certificate completes the TLS handshake; the client's downstream handlers see handshake success and send sensitive requests before the delayed OCSP query returns REVOKED and the channel is closed.
**Insight:** When a security check is asynchronous, verify no success event is propagated to downstream handlers before the check resolves; gate handshake-completion events behind the OCSP result rather than closing the channel afterward.