Netty versions prior to 4.1.135.Final, and 4.2.0.Final through 4.2.15.Final, contain an OCSP client that does not verify that the CertificateID returned in an OCSP response matches the one requested. An attacker can replay a signed OCSP response for a different certificate issued by the same CA, causing the client to accept the response as a GOOD status for the target certificate. This allows the attacker to bypass revocation checks and is identified as CWE-295, Input Validation Failure. Based on the description, it is inferred that the attacker must capture or forge OCSP traffic, implying network-based interaction to supply the malformed response.

Netty, the Java network application framework, is affected. Vulnerable releases include Netty 4.1.0.Final through 4.1.134.Final and Netty 4.2.0.Final through 4.2.15.Final. The issue is fixed in Netty 4.1.136.Final and Netty 4.2.16.Final.

The vulnerability carries a CVSS score of 7.4, indicating high severity. The EPSS score is 0.00182, which is less than 1%. The CVE is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a forged OCSP response to a client that trusts the CA issuing the certificate, which can be achieved over the network by controlling the OCSP responder or intercepting OCSP traffic. The attack vector is therefore network-based and likely remote. Based on the description, the attacker must supply a forged response, implying remote network interaction.