AIKIDO-2026-746446
netty-handler-ssl-ocsp is vulnerable to Improper Certificate Validation
74
High Risk
This Affects:
netty-handler-ssl-ocspTL;DR
Netty's OcspClient validates the OCSP responder's certificate chain but never checks that the responder certificate carries the id-kp-OCSPSigning Extended Key Usage required by RFC 6960, because validateSignature builds the path without that constraint. Any certificate validly issued by the CA can therefore sign OCSP responses. A holder of such a certificate can forge GOOD responses for revoked certificates, defeating revocation checking and enabling man-in-the-middle. The fix verifies the OCSP-signing Extended Key Usage on the responder certificate.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you rely on Netty's OCSP client to reject revoked certificates.
Background info
netty-handler-ssl-ocsp is vulnerable to Improper Certificate Validation in versions 4.1.0.Final - 4.1.137.Final and 4.2.0.Final - 4.2.17.Final.
How to fix this
Upgrade the io.netty:netty-handler-ssl-ocsp library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.