{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/netty-handler--4.1.136.final/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-62243"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["netty-handler (4.2.0.Final - 4.2.16.Final)","netty-handler (\u003c= 4.1.136.Final)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2026-62243 affects Netty's netty-handler library, specifically versions 4.2.0.Final through 4.2.16.Final and 4.1.136.Final and earlier. The vulnerability exists within the SslProvider.OPENSSL client path. When these specific versions are deployed in environments utilizing Java 25 or later, or in environments where Unsafe-based trust-manager wrapping is unavailable, the client fails to perform TLS hostname verification.\u003c/p\u003e\n\u003cp\u003eThis flaw results in the client accepting certificates issued for arbitrary hostnames, provided a plain X509TrustManager is in use. A man-in-the-middle attacker can exploit this misconfiguration to intercept encrypted traffic, bypassing the identity validation layer of the TLS handshake. Defenders should prioritize updating to Netty versions 4.2.17.Final or 4.1.137.Final to remediate the vulnerability. Given the library's widespread use in Java-based applications, it is critical to identify all services incorporating these versions of netty-handler.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a man-in-the-middle attacker to decrypt, observe, and potentially modify sensitive data in transit between a client and a server. This impact is significant for applications handling authentication credentials, API keys, or personal identifiable information. As this vulnerability affects the core network communication layer, any Java application relying on the affected Netty versions as a TLS client is susceptible to traffic interception if the network path can be influenced by an attacker.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of netty-handler to 4.2.17.Final or 4.1.137.Final to resolve CVE-2026-62243.\u003c/li\u003e\n\u003cli\u003eAudit application dependencies to identify versions of io.netty:netty-handler within the vulnerable ranges (4.2.0.Final-4.2.16.Final or \u0026lt;= 4.1.136.Final).\u003c/li\u003e\n\u003cli\u003eUntil patching is completed, restrict network access for affected applications to trusted environments to mitigate the risk of man-in-the-middle positioning.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-22T17:32:02Z","date_published":"2026-08-22T17:32:02Z","id":"https://feed.craftedsignal.io/briefs/2026-08-netty-tls-hostname-verification/","summary":"Netty's netty-handler library fails to perform TLS hostname verification when using the OpenSSL provider on Java 25+ systems, enabling potential man-in-the-middle attacks.","title":"TLS Hostname Verification Bypass in Netty","url":"https://feed.craftedsignal.io/briefs/2026-08-netty-tls-hostname-verification/"}],"language":"en","title":"CraftedSignal Threat Feed - Netty-Handler (\u003c= 4.1.136.Final)","version":"https://jsonfeed.org/version/1.1"}