Executive brief
Netty is a Java networking library widely used to build distributed systems and web services. Versions 4.2.0 through 4.2.16 and 4.1.x through 4.1.136 disable TLS hostname verification when running on Java 25+ with the OpenSSL provider. This allows an attacker on the network to intercept connections and present forged certificates for different domains that are silently accepted, enabling account takeover and data interception without detection.
Technical details
The vulnerability is a TLS hostname verification bypass (CWE-297) affecting Netty's OpenSSL client implementation. When Unsafe-based reflection is unavailable (Java 25+), the hostname verification wrapper defaults to a no-op implementation that returns the plain X509TrustManager without adding verification logic. An attacker positioned as a man-in-the-middle can present a valid certificate issued for a different hostname that will be accepted without validation. The vulnerability requires the use of OpenSSL provider (SslProvider.OPENSSL) with a plain X509TrustManager and Java 25+. Patches are available in versions 4.2.17.Final and 4.1.137.Final.
Affected products
- Netty netty-handler 4.2.0.Final through 4.2.16.Final; 4.1.x through 4.1.136.Final
Timeline
- 2026-08-22: disclosed
- 2026-08-22: patched: 4.2.17.Final and 4.1.137.Final