The vulnerability in io.netty.handler.ssl.ocsp.OcspServerCertificateValidator arises because the freshness check for OCSP responses does not halt processing when an out-of-date response is detected. Specifically, the method userEventTriggered logs an exception for stale OCSP responses but still fires a VALID OcspValidationEvent, effectively accepting expired GOOD responses. Since nonce validation is optional and disabled by default, the freshness check is the primary defense against replay attacks, but it is not enforced. Furthermore, the code may throw a NullPointerException if getNextUpdate() returns null. This flaw enables an attacker positioned on the network path to replay stale but valid OCSP responses, bypassing certificate revocation mechanisms.

An attacker with network access can replay expired but previously valid OCSP responses, causing the system to incorrectly treat revoked certificates as valid. This undermines the certificate revocation checking process, potentially allowing the use of revoked certificates for malicious purposes. There is no indication of known exploits in the wild. The vulnerability affects the integrity and trustworthiness of SSL/TLS certificate validation in affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider enabling nonce validation if possible to strengthen replay protection. Monitor vendor channels for updates addressing this issue. Avoid relying solely on the freshness check for OCSP response validation due to its current ineffective enforcement.