Executive brief
Netty is a popular networking framework used by many Java applications to handle secure communications. A flaw in its certificate checking component allows an attacker to bypass security checks by reusing a valid status message from a different, unrelated certificate. This could allow a connection using a revoked or fraudulent certificate to be incorrectly trusted, potentially leading to intercepted data or unauthorized access.
Technical details
The vulnerability exists in io.netty.handler.ssl.ocsp.OcspClient#validateResponse, which fails to assert that the CertificateID within a returned BasicOCSPResp matches the original certificate being validated. While the client verifies the digital signature of the OCSP response, it ignores the payload's identity field. An attacker with any valid, non-revoked certificate from the same Certificate Authority (CA) can capture a 'GOOD' OCSP response and replay it to satisfy the revocation check for a different, potentially revoked certificate. This violates RFC 6960 requirements for OCSP clients. The issue is patched in versions 4.1.136.Final and 4.2.16.Final.
Affected products
- Netty netty-handler-ssl-ocsp >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final
Timeline
- 2026-07-14: disclosed
- 2026-07-21: advisory: NVD publication
- 2026-07-22: patched: GitHub Advisory reviewed and updated with patch versions