Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final, the OCSP stapling validator in netty-handler-ssl-ocsp contains a time-of-check/time-of-use (TOCTOU) race condition. The certificate's revocation status is checked at one point in time, but the certificate itself may be revoked between the check and when it is actually used. An attacker can exploit this timing window to use a revoked certificate for authentication. This issue is fixed in versions 4.1.136.Final and later.