Read the docs
TI-2026-44466 Aliases CVE-2026-62243GHSA-c3j3-64rf-grvf

Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass

Priority MEDIUM 43CWE-297Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 20 fixed, 14 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00155 4th percentileScored 2026-11-07
Fix Partial netty (netty): 4.2.16.Final, 4.1.137.FinalRed Hat: 20 advisoriesRed Hat: 20 fixed, 14 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynetty4.2.0.Final to before 4.2.16.Final4.2.16.FinalPatch availableCNA
nettynettybefore 4.1.137.Final4.1.137.FinalPatch availableCNA
  • netty Vendornetty Affected 4.2.0.Final to before 4.2.16.Final Fixed in 4.2.16.Final Patch available CNA
  • netty Vendornetty Affected before 4.1.137.Final Fixed in 4.1.137.Final Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*——netty
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions — — ·netty

Remediation

  • Fix · CNA netty (netty) Fixed in 4.2.16.Final
  • Fix · CNA netty (netty) Fixed in 4.1.137.Final

Red Hat 20 advisories

  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
Show 17 more Red Hat advisories
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:83612 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Debezium 3.6.3 release
    • Red Hat Build of Debezium 3.6
  • RHSA-2026:71675 Released 2026-09-24 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16
  • RHSA-2026:70277 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss Enterprise Application Platform 8.1.8.GA com.fasterxml.jackson.core.jackson-core-2.18.9.redhat-00003.jar, com.fasterxml.jackson.core.jackson-databind-2.18.9.redhat-00003.jar, io.netty.netty-codec-4.1.136.Final-redhat-00001.jar +17
  • RHSA-2026:70230 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss EAP 8.1 for RHEL 10 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el10eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el10eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el10eap +47
  • RHSA-2026:70228 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el8eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el8eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el8eap +47
  • RHSA-2026:70229 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el9eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el9eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el9eap +47
  • RHSA-2026:69296 Released 2026-09-21 · Red Hat rating Important
    Red Hat Data Grid 8.6.3 security update
    • Red Hat Data Grid 8.6.3
  • RHSA-2026:68276 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.16 Images Security Update
    • Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:68277 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.7 Images Security Update
    • Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:68280 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.16 Security Update
    • Red Hat build of Keycloak 26.4.16
  • RHSA-2026:68278 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.7 Security Update
    • Red Hat build of Keycloak 26.6.7
  • RHSA-2026:66545 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.6 release and security update
    • Red Hat AMQ Broker 7.13.6
  • RHSA-2026:66488 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.1 release and security update
    • Red Hat AMQ Broker 7.14.1
  • RHSA-2026:63302 Released 2026-09-03 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)
    • Red Hat Build of Apache Camel 3.33.3.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-qute-3.33.3.redhat-00005.jar +5
  • RHSA-2026:62555 Released 2026-09-03 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.3.SP1 release and security update
    • Red Hat build of Quarkus 3.33.3.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-oidc-3.33.3.redhat-00005.jar +6
  • RHSA-2026:62515 Released 2026-09-03 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.5.SP1 release and security update
    • Red Hat build of Quarkus 3.27.5.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-apache-httpclient-3.27.5.redhat-00004.jar +7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    netty 4.1.137.Final, 4.2.16.Final

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-44520 Netty before 4.2.16.Final SOCKS Proxy Null Byte InjectionPriority LOW 28
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat Ceph Storage 6AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat AMQ Broker 7.13.6Fixed RHSA-2026:66545
Red Hat AMQ Broker 7.14.1Fixed RHSA-2026:66488
Red Hat Build of Apache Camel 3.33.3.SP1Fixed RHSA-2026:63302
Red Hat Build of Debezium 3.6Fixed RHSA-2026:83612
Red Hat Data Grid 8.6.3Fixed RHSA-2026:69296
Red Hat JBoss EAP 8.1 for RHEL 10Fixed RHSA-2026:70230
Red Hat JBoss EAP 8.1 for RHEL 8Fixed RHSA-2026:70228
Red Hat JBoss EAP 8.1 for RHEL 9Fixed RHSA-2026:70229
Red Hat JBoss Enterprise Application Platform 8.1.8.GAFixed RHSA-2026:70277
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16Fixed RHSA-2026:71675
Red Hat build of Keycloak 26.4Fixed RHSA-2026:68276
Red Hat build of Keycloak 26.4.16Fixed RHSA-2026:68280
Red Hat build of Keycloak 26.6Fixed RHSA-2026:68277
Red Hat build of Keycloak 26.6.7Fixed RHSA-2026:68278
Red Hat build of Quarkus 3.27.5.SP1Fixed RHSA-2026:62515
Red Hat build of Quarkus 3.33.3.SP1Fixed RHSA-2026:62555
Not affected: 12 products
  • Red Hat Build of Apache Camel 3.33.3.SP1
  • Red Hat JBoss Enterprise Application Platform 8.1.8.GA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Offline Knowledge Portal
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift AI 3.5
  • Red Hat OpenShift Dev Spaces 3.31
  • Red Hat Satellite 6
  • Red Hat build of Quarkus 3.27.5.SP1
  • Red Hat build of Quarkus 3.33.3.SP1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-62243
  2. 2026-10-03 Alias added: GHSA-c3j3-64rf-grvf
  3. 2026-10-09 Fix available: RHSA-2026:62555 · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:70277 · Red Hat
  5. 2026-10-09 Fix available: RHSA-2026:63302 · Red Hat
  6. 2026-10-09 Fix available: RHSA-2026:62515 · Red Hat
  7. 2026-10-09 Fix available: Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1, Red Hat JBoss Enterprise Application Platform 8.1, Red Hat build of Quarkus 3.27.5.SP1 +1 · Red Hat
  8. 2026-10-12 Fix available: Red Hat Build of Apache Camel 3.33.3.SP1 · Red Hat
  9. 2026-10-16 Fix available: RHSA-2026:83612 · Red Hat
  10. 2026-10-16 Fix available: Red Hat Build of Debezium 3.6 · Red Hat
  11. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  12. 2026-10-20 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.8.GA, Red Hat OpenShift AI 3.4 · Red Hat
  13. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  14. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  15. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.5 · Red Hat
  16. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  17. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat

References

Advisory 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-64821 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass CVSS 4.0HIGH 8.7
  • TI-2026-64818 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS CVSS 4.0HIGH 8.7
See all 114 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences