Netty's OcspClient Vulnerability: Potential Bypass of Certificate Revocation
An early warning has been issued regarding a vulnerability in Netty's OcspClient that reportedly allows a bad actor to bypass revocation checks for any certificate by not validating that the CertificateID in an OCSP response matches the requested CertificateID.
What happened
The vulnerability, tracked as GHSA-272M-GCWP-MPWG, appears to affect the netty component available via maven. This issue could potentially allow an attacker to conduct replay attacks by exploiting the lack of CertificateID validation in OCSP responses. It is under investigation whether this vulnerability has been actively exploited.
Professional software engineers using Netty are advised to assess their exposure by reviewing their dependencies for any inclusion of the affected netty component. It is recommended to upgrade to a version of Netty that includes the fix for the OCSP response validation issue as soon as it becomes available.
For more detailed information, primary sources should be consulted, including the GitHub security advisories and the NCSC advisory NCSC-2026-0258. These sources provide further context and may offer additional recommendations or patches as they become available.
How 0Day mitigates this
netty is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.