# CVE-2026-100665: Netty incomplete hostname verification in QUIC certificate verification

Source: https://junglewise.ai/threats/cve-2026-100665-netty-versions-from-4-2-11-final-before-4-2-18-final-contain-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100665 · Severity: high · CVSS 7.5 · Published 2026-09-26

Netty, a popular network communication library, has a flaw in its QUIC protocol implementation that bypasses hostname verification when using plain X509TrustManager. An attacker on the network path can present a certificate for the wrong hostname, which the library will accept, potentially allowing man-in-the-middle attacks on QUIC clients.

Technologies: [Netty Project Netty](https://junglewise.ai/threats/technologies/netty-project-netty). Vendors: [Netty Project](https://junglewise.ai/threats/vendors/netty-project).

## Quick answers

**Is CVE-2026-100665 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100665 being exploited in the wild.

**How severe is CVE-2026-100665?** High severity, with a CVSS score of 7.5, published 26 September 2026.

**Which products and versions are affected?** Netty Project Netty 4.2.11.Final to before 4.2.18.Final.

**Is there a fix for CVE-2026-100665?** A patch was published on 2026-06-01: Fix applied in commit 09e72c4fd8007277121ed48db63a124b112b96fe Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100665 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100665?** Check whether you run Netty Project Netty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the BoringSSLCertificateVerifyCallback, which discards the SSLEngine for plain trust managers, preventing endpoint identification from running even when HTTPS verification is configured. When a plain X509TrustManager is wrapped into X509ExtendedTrustManager, hostname verification is silently disabled. Attackers can exploit this via a network attack vector to present invalid certificates.

## Affected products

- Netty Project Netty 4.2.11.Final to before 4.2.18.Final

## Timeline

- 2026-09-26: disclosed
- 2026-06-01: patched: Fix applied in commit 09e72c4fd8007277121ed48db63a124b112b96fe

## References

- [https://github.com/netty/netty/commit/09e72c4fd8007277121ed48db63a124b112b96fe](https://github.com/netty/netty/commit/09e72c4fd8007277121ed48db63a124b112b96fe)
- [https://github.com/netty/netty/commit/994e887ed9](https://github.com/netty/netty/commit/994e887ed9)

## Related threats

- [Netty netty-codec-http request smuggling via chunk-size parsing](https://junglewise.ai/threats/cve-2026-93574-a-flaw-was-found-in-netty-s-netty-codec-http-component-a-remote)
- [Netty HTTP/2 header injection vulnerability](https://junglewise.ai/threats/cve-2026-93579-a-flaw-was-found-in-netty-s-http-2-stack-this-vulnerability)
- [Netty RedisArrayAggregator heap memory exhaustion](https://junglewise.ai/threats/cve-2026-93572-a-flaw-was-found-in-netty-s-redisarrayaggregator-component-a)
- [Netty SmtpResponseDecoder unbounded memory accumulation](https://junglewise.ai/threats/cve-2026-93563-a-flaw-was-found-in-netty-s-smtpresponsedecoder-component-a)
- [Netty memory leak in StompSubframeDecoder](https://junglewise.ai/threats/cve-2026-93494-a-flaw-was-found-in-netty-s-stompsubframedecoder-component-a)