8.7
High
CVE-2026-100665 Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC…
Description
Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint identification from running even when HTTPS verification is configured. Attackers on the network path can present a certificate chain for the wrong hostname that the plain trust manager accepts, bypassing hostname authentication for QUIC clients.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| netty 4.2 | 4.2.11.Final → < 4.2.18.Final | 4.2.18.Final |
References
- GitHub Security Advisory (GHSA-mj35-3qqm-q387) github.com
- Patch Commit github.com
- Patch Commit github.com
- VulnCheck Advisory: Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of netty
The 95 CVEs of netty →
CVE-2026-100666
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to…
6.9
Medium
CVE-2026-100664
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority…
8.7
High
CVE-2026-100663
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1…
8.7
High
CVE-2026-100661
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a…
8.7
High