Netty 4.2.04.16 / 4.1.0136 OpenSSL TLS Hostname Verify Bypass
CVE-2026-62243 Published on August 22, 2026
Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass
Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.
Vulnerability Analysis
CVE-2026-62243 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Improper Validation of Certificate with Host Mismatch
The software communicates with a host that provides a certificate, but the software does not properly ensure that the certificate is actually associated with that host.
Products Associated with CVE-2026-62243
Want to know whenever a new CVE is published for Netty? stack.watch will email you.
Affected Versions
netty:- Version 4.2.0.Final and below 4.2.16.Final is affected.
- Version 4.2.16.Final is unaffected.
- Before 4.1.137.Final is affected.
- Version 4.1.137.Final is unaffected.