Executive brief
Netty is a widely used networking framework for Java applications. A flaw in its certificate validation component allows an attacker to present an expired security status for a certificate that has actually been revoked. This could allow an attacker to impersonate a trusted service or intercept encrypted communications even after their security credentials have been officially cancelled.
Technical details
A vulnerability exists in the OcspServerCertificateValidator#userEventTriggered method where a freshness check failure does not trigger a return statement. Consequently, even if an IllegalStateException is fired due to an out-of-date response, the execution falls through and emits a VALID OcspValidationEvent. Because nonce validation is disabled by default, an on-path attacker can replay a stale 'GOOD' OCSP response to make a revoked certificate appear valid. Additionally, the component may throw a NullPointerException if the getNextUpdate() field is null. The issue is resolved in versions 4.1.136.Final and 4.2.16.Final.
Affected products
- Netty netty-handler-ssl-ocsp < 4.1.136.Final, >= 4.2.0.Final, < 4.2.16.Final
Timeline
- 2026-07-14: advisory: GitHub advisory published by maintainers
- 2026-07-28: disclosed: NVD publication date