The vulnerability in io.netty.handler.ssl.ocsp.OcspClient arises because the validateResponse method does not verify that the CertificateID in the BasicOCSPResp matches the CertificateID of the certificate being checked. While the OCSP response signature is verified against the trusted issuer, the client ignores whether the response corresponds to the queried certificate. An attacker with access to a valid OCSP response for any non-revoked certificate issued by the same CA can replay that response to bypass revocation checks for other certificates, including revoked ones. This behavior violates RFC 6960 section 3.2, which mandates that OCSP clients confirm the certificate identity in the response matches the request. A proof-of-concept test demonstrates this bypass.

This vulnerability allows an attacker to bypass OCSP revocation checks by replaying a valid OCSP response for an unrelated certificate issued by the same CA. As a result, revoked certificates may be incorrectly accepted as valid by the Netty client, potentially undermining the security guarantees of certificate revocation and enabling use of compromised or revoked certificates.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be aware of this validation omission and consider additional certificate revocation verification methods or avoid relying solely on Netty's OCSP client for critical validation.