Tag
#Netty
CVE-2026-62243: Netty TLS Hostname Verification Bypass
CVE-2026-62243 is a vulnerability in Netty's OpenSSL client path that allows a man-in-the-middle attacker to present a certificate issued for a different hostname without validation. This occurs when using a plain X509TrustManager and Unsafe-based trust-manager wrapping is unavailable. The vulnerability has a CVSS score of 7.5 and is fixed in Netty versions 4.2.17.Final and 4.1.137.Final.
Understanding the Netty QUIC Token Handler Vulnerability
A vulnerability in Netty's default QUIC token handler allows an attacker to bypass anti-amplification limits, potentially leading to denial-of-service attacks. The issue arises from the token handler's improper validation of client-supplied tokens.
Netty SNI Handler Vulnerability Allows for Large Memory Allocation
A vulnerability in Netty's SNI handler allows for large memory allocation from a small amount of attacker-controlled data, potentially leading to a denial-of-service attack.