Executive brief
Netty's OCSP (Online Certificate Status Protocol) validation component contains a flaw that allows remote attackers to bypass certificate validation checks. By crafting a specially malformed OCSP response, an attacker can cause the validation to be silently skipped, allowing an application to accept invalid or revoked certificates that should have been rejected. This undermines the security controls that applications depend on to ensure TLS connections are established with legitimate servers.
Technical details
This vulnerability is a certificate revocation check bypass (CWE-299) in Netty's OCSP validation logic. The flaw occurs when a remote attacker provides an OCSP response that omits the optional `nextUpdate` field; the validator fails to properly handle this edge case and silently skips validation instead of rejecting the malformed response. An attacker with network access can exploit this by performing a man-in-the-middle attack and presenting a specially crafted OCSP response during TLS handshakes. The attack requires high attack complexity (the attacker must control or intercept the OCSP response), but succeeds without authentication or user interaction. The result is integrity compromise: applications accept unvalidated certificates, potentially enabling impersonation attacks and data theft. Mitigation is not currently available via Red Hat.
Affected products
- Netty netty-handler-ssl-ocsp <UNKNOWN>
Timeline
- 2026-09-18: disclosed