CVE-2026-62243 - Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass
Brief
CVE ID : CVE-2026-62243
Published : Aug. 22, 2026, 12:26 p. m.
- 44 minutes ago
Description : Netty (io. netty:netty-handler) versions from 4.
- 0. Final through 4.
- 16. Final and versions through 4.
- 136. Final disable TLS hostname verification on the SslProvider. OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+).
In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.
- 17. Final and 4.
- 137. Final.
Severity: 8.7
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...