# Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

Netty's OcspServerCertificateValidator logs an out-of-date OCSP response but still fires VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation.

- Payout: Research
- Severity: high
- Program: Netty
- Found by: violetagg
- Disclosed: 2026-07-22
- CVE: CVE-2026-56821
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-g7hg-vrcf-mvmr
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-g7hg-vrcf-mvmr
- Tags: area:oss domain:oss impact:integrity kind:research platform:ghsa sev:high tech:java technique:source-review vuln:auth-bypass vuln:crypto

**Target:** io.netty.handler.ssl.ocsp.OcspServerCertificateValidator (TLS client OCSP stapling check)
**Root cause:** The freshness check in userEventTriggered fires an IllegalStateException but lacks a return, so execution falls through and a VALID OcspValidationEvent is still emitted. Nonce validation is off by default, so freshness is the only replay defense.
**Steps:**
1. Build a target cert with an AIA OCSP extension and a CA root.
2. Craft a BasicOCSPResp with CertificateStatus.GOOD and thisUpdate/nextUpdate both 7 days in the past, signed by the CA.
3. Serve that encoded OCSP response over a mocked transport returning Content-Type application/ocsp-response.
4. Connect a client with OcspServerCertificateValidator(true, false, ...) to the server.
5. Observe OcspValidationEvent with status VALID is fired despite the stale response (only an IllegalStateException is also raised).
**How found:** Code reading of the freshness branch: noticed the IllegalStateException is thrown without a return, so the VALID event still fires; also noted getNextUpdate() may be null causing NPE in current.before(null).
**Exploitation:** An on-path attacker intercepts the OCSP fetch and replays a previously captured, now-expired GOOD response for a certificate that has since been revoked; because the validator still emits VALID, the revoked certificate is accepted.
**Insight:** In OCSP/CRL validation code, verify that a failed freshness or signature check actually aborts the flow (return/throw) rather than merely logging; and treat optional nonce validation as absent, making thisUpdate/nextUpdate the sole replay defense to audit.