A security vulnerability in the Netty network application framework allows an on-path attacker to bypass certificate revocation checks. The OcspServerCertificateValidator component fails to reject expired OCSP responses, reporting them as VALID even when they are out-of-date. This enables an attacker to replay a stale GOOD OCSP response to bypass revocation of a since-revoked certificate. Any application using the OcspServerCertificateValidator is affected, meaning revoked certificates can be accepted as valid. The vulnerability affects Netty versions prior to 4.1.136.Final and 4.2.16.Final. Fixes have been released in versions 4.1.136.Final and 4.2.16.Final. This is a medium-to-high severity issue as it undermines PKI trust mechanisms and certificate lifecycle management.