OCSP response replay bypass in Netty OcspServerCertificateValidator (CVE-2026-56821)

`OcspServerCertificateValidator` in the `io.netty:netty-handler-ssl-ocsp` package fires a `VALID` `OcspValidationEvent` even after detecting an out-of-date OCSP response, because the freshness check lacks a `return` statement to halt further processing. An on-path attacker can replay a stale GOOD response to bypass revocation checking for a since-revoked certificate. Additionally, a `null` value from `getNextUpdate()` causes a `NullPointerException`. Public POC available. Affected versions: - <=4.2.15.Final - <=4.1.135.Final We recommend updating to: 4.2.16.Final, 4.1.136.Final. CVSS 7.4 · our assessment: this_week Reference: https://github.com/netty/netty/security/advisories/GHSA-g7hg-vrcf-mvmr Details: https://vuln.today/cve/CVE-2026-56821