{}

{}

{}

{"bugzilla": {"description": "io.netty/netty-handler-ssl-ocsp: Netty: Time-of-check/time-of-use in netty-handler-ssl-ocsp", "id": "2507478", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507478"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in Netty's `netty-handler-ssl-ocsp` component. This vulnerability involves a time-of-check/time-of-use (TOCTOU) race condition within the OCSP stapling validator. A remote attacker could exploit this timing window, allowing them to use a certificate that has been revoked for authentication purposes. This could lead to unauthorized access or bypass of security controls."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-56822", "package_state": [{"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "impact": "moderate", "package_name": "netty-handler-ssl-ocsp", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Fix deferred", "impact": "moderate", "package_name": "netty-handler-ssl-ocsp", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "impact": "moderate", "package_name": "netty-handler-ssl-ocsp", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}], "public_date": "2026-07-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-56822\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-56822\nhttps://github.com/netty/netty/security/advisories/GHSA-wc96-39fc-566f"], "statement": "This Moderate impact vulnerability in the `netty-handler-ssl-ocsp` component, present in Red Hat products such as JBoss Data Grid, Enterprise Application Platform, and Red Hat build of Apache Camel, involves a time-of-check/time-of-use (TOCTOU) race condition within its OCSP stapling validator. This flaw could allow an attacker to exploit a timing window, enabling the use of a revoked certificate for authentication. The impact is considered Moderate due to the specific timing window required for exploitation.", "threat_severity": "Important"}

{}