Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwa…

A vulnerability in the Netty network application framework allows sensitive data to be sent to servers with revoked TLS certificates due to a race condition in OCSP validation. The OcspServerCertificateValidator prematurely forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes, causing downstream handlers to believe the TLS handshake succeeded. This allows clients to transmit sensitive application data such as HTTP requests to a revoked server before the channel is eventually closed. The flaw exists in io.netty.handler.ssl.ocsp.OcspServerCertificateValidator where the handshake event is fired immediately while the OCSP query runs asynchronously. Affected versions are prior to 4.1.136.Final and 4.2.16.Final. The issue has been patched in Netty versions 4.1.136.Final and 4.2.16.Final. Organizations using Netty with OCSP certificate validation should upgrade immediately to mitigate the risk of data leakage to compromised or malicious servers.