CVE-2026-100665GHSA-mj35-3qqm-q387
Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass
netty nettyFrameworks
CVSS
8.7HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 2 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.2.18.FinalnettyCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint identification from running even when HTTPS verification is configured. Attackers on the network path can present a certificate chain for the wrong hostname that the plain trust manager accepts, bypassing hostname authentication for QUIC clients.
Text from CVE List
Affected versions 2
- nettyaffected: 4.2.11.Final before 4.2.18.FinalCVE List
- nettyunaffected: 4.2.18.FinalCVE List
References 4
- github.com/netty/netty/commit/09e72c4fd8007277121ed48db63a124b112b96feFixvia CVE List
- github.com/netty/netty/commit/994e887ed9Fixvia CVE List
- vulncheck.com/advisories/netty-4.2.11-through-4.2.17-quic-hostname-verification-bypassAdvisoryvia CVE List
- github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387Exploitvia CVE List