Is CVE-2026-100665 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100665 being exploited in the wild.

How severe is CVE-2026-100665?

High severity, with a CVSS score of 7.5, published 26 September 2026.

Which products and versions are affected?

Netty Project Netty 4.2.11.Final to before 4.2.18.Final.

Is there a fix for CVE-2026-100665?

A patch was published on 2026-06-01: Fix applied in commit 09e72c4fd8007277121ed48db63a124b112b96fe Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100665 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100665?

Check whether you run Netty Project Netty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100665: Netty incomplete hostname verification in QUIC certificate verification

CVE-2026-100665 · Severity: high · CVSS 7.5 · Published 2026-09-26

Netty, a popular network communication library, has a flaw in its QUIC protocol implementation that bypasses hostname verification when using plain X509TrustManager. An attacker on the network path can present a certificate for the wrong hostname, which the library will accept, potentially allowing man-in-the-middle attacks on QUIC clients.

Technologies: Netty Project Netty. Vendors: Netty Project.

Quick answers

Is CVE-2026-100665 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100665 being exploited in the wild.
How severe is CVE-2026-100665?: High severity, with a CVSS score of 7.5, published 26 September 2026.
Which products and versions are affected?: Netty Project Netty 4.2.11.Final to before 4.2.18.Final.
Is there a fix for CVE-2026-100665?: A patch was published on 2026-06-01: Fix applied in commit 09e72c4fd8007277121ed48db63a124b112b96fe Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100665 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100665?: Check whether you run Netty Project Netty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the BoringSSLCertificateVerifyCallback, which discards the SSLEngine for plain trust managers, preventing endpoint identification from running even when HTTPS verification is configured. When a plain X509TrustManager is wrapped into X509ExtendedTrustManager, hostname verification is silently disabled. Attackers can exploit this via a network attack vector to present invalid certificates.

Affected products

Netty Project Netty 4.2.11.Final to before 4.2.18.Final

Timeline

2026-09-26: disclosed
2026-06-01: patched: Fix applied in commit 09e72c4fd8007277121ed48db63a124b112b96fe

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.