CVE-2026-100665: Netty incomplete hostname verification in QUIC certificate verification

Executive brief

Netty, a popular network communication library, has a flaw in its QUIC protocol implementation that bypasses hostname verification when using plain X509TrustManager. An attacker on the network path can present a certificate for the wrong hostname, which the library will accept, potentially allowing man-in-the-middle attacks on QUIC clients.

Technical details

The vulnerability exists in the BoringSSLCertificateVerifyCallback, which discards the SSLEngine for plain trust managers, preventing endpoint identification from running even when HTTPS verification is configured. When a plain X509TrustManager is wrapped into X509ExtendedTrustManager, hostname verification is silently disabled. Attackers can exploit this via a network attack vector to present invalid certificates.

Affected products

• Netty Project Netty 4.2.11.Final to before 4.2.18.Final

Timeline

• 2026-09-26: disclosed
• 2026-06-01: patched: Fix applied in commit 09e72c4fd8007277121ed48db63a124b112b96fe

References

• https://github.com/netty/netty/commit/09e72c4fd8007277121ed48db63a124b112b96fe
• https://github.com/netty/netty/commit/994e887ed9