Fluid Attacks Database

Description

Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	netty	=1:4.1.48-10 \|\| =1:4.1.48-11 \|\| =1:4.1.48-12 \|\| =1:4.1.48-13 \|\| =1:4.1.48-14 \|\| =1:4.1.48-15 \|\| =1:4.1.48-16 \|\| =1:4.1.48-7 \|\| =1:4.1.48-7+deb12u1 \|\| =1:4.1.48-7+deb12u2 \|\| =1:4.1.48-8 \|\| =1:4.1.48-9	-
rpm rhel10	ceph	-	-
maven	io.netty:netty-handler	>=0 <4.1.137 \|\| >=4.2.0 <4.2.17	4.1.137, 4.2.17
maven	io.netty:netty-all	>=4.1.1 <4.1.69	-
debian 14	netty	=1:4.1.48-10 \|\| =1:4.1.48-11 \|\| =1:4.1.48-12 \|\| =1:4.1.48-13 \|\| =1:4.1.48-14 \|\| =1:4.1.48-15 \|\| =1:4.1.48-16	-
debian 13	netty	=1:4.1.48-10 \|\| =1:4.1.48-10+deb13u1 \|\| =1:4.1.48-11 \|\| =1:4.1.48-12 \|\| =1:4.1.48-13 \|\| =1:4.1.48-14 \|\| =1:4.1.48-15 \|\| =1:4.1.48-16	-

Aliases

1. CVE-2026-622432. NVD-2026-622433. OSV-DEBIAN-2026-622434. OSV-2026-622435. GCVE-2026-622436. SECURITY-TRACKER-CVE-2026-622437. GHSA-p85m-gvr3-788c

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.