CVE-2026-62243: netty 4.2.0.Final to before 4.2.16.Final, 0 to before 4.1.137.Final

Affected technology

netty · 4.2.0.Final to before 4.2.16.Final
netty

netty · 0 to before 4.1.137.Final
netty

Description’s affected range: versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+)

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

A man-in-the-middle attacker can present a certificate issued for a different hostname that is accepted without validation. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality impact as high; integrity and availability impact as none.