Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition in Netty's OcspServerCertificateValidator. The userEventTriggered method in this class would immediately fire an SslHandshakeCompletionEvent upon a successful TLS handshake, before the asynchronous OCSP certificate validation was complete. This would cause downstream handlers in the pipeline to believe the connection was secure and begin sending application data. If the OCSP check later failed (e.g., because the server's certificate was revoked), the channel would be closed, but not before potentially sensitive data had already been transmitted.
The patch rectifies this by making OcspServerCertificateValidator a ByteToMessageDecoder that buffers any incoming data. It also overrides the read() method to pause reading from the channel while the OCSP query is in flight. The crucial change is in userEventTriggered, where the SslHandshakeCompletionEvent is now only fired after the OCSP validation completes successfully within the asynchronous listener. This ensures that the channel is not considered fully ready for application data until the server's certificate has been validated, thus closing the race condition window.
io.netty.handler.ssl.ocsp.OcspServerCertificateValidator.userEventTriggeredhandler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspServerCertificateValidator.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.netty:netty-handler-ssl-ocsp | maven | >= 4.2.0.Final, < 4.2.16.Final | 4.2.16.Final |
| io.netty:netty-handler-ssl-ocsp | maven | < 4.1.136.Final | 4.1.136.Final |