CVE-2026-62243 — Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass

Description

Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.

Affected products

Vendor	Product	Affected	Fixed
netty	netty	4.2.0.Final – < 4.2.16.Final, < 4.1.137.Final	4.2.16.Final

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	netty	No fix yet	—
Debian 13	netty	No fix yet	—
Debian 12	netty	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	netty	No fix yet	—

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 26.04 LTS	netty	No fix yet	—
Ubuntu Pro 24.04 LTS	netty	No fix yet	—
Ubuntu Pro 22.04 LTS	netty	No fix yet	—
Ubuntu Pro 20.04 LTS	netty	No fix yet	—
Ubuntu Pro 18.04 LTS	netty	No fix yet	—
Ubuntu Pro 16.04 LTS	netty	No fix yet	—
Ubuntu Pro 14.04 LTS	netty	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss EAP 8	eap8-activemq-artemis +14	2.40.0-8.redhat_00024.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-apache-cxf +3	4.1.7-1.SP1_redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-artemis-wildfly-integration	2.0.5-1.Final_redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-bouncycastle +5	1.85.0-1.redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-cryptacular	1.2.7-1.redhat_00002.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-eap-product-conf-parent +1	801.8.0-1.GA_redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-hibernate +2	6.6.54-1.Final_redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-httpcomponents-asyncclient	4.1.5-5.redhat_00008.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-ironjacamar +8	3.0.22-1.Final_redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-jackson-core +12	2.18.9-1.redhat_00003.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-jakarta-xml-bind-api	4.0.5-1.redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-jaxb +9	4.0.7-4.redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-jaxbintros	2.1.0-1.redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-jboss-logging	3.6.3-1.Final_redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-jboss-remoting	5.0.31-1.SP2_redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-jbossws-api	3.1.0-1.Final_redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-jbossws-common-tools	2.2.0-1.Final_redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-jbossws-cxf	7.4.0-1.Final_redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-jbossws-jaxws-undertow-httpspi	3.0.1-1.Final_redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-jbossws-spi	5.1.0-1.Final_redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-jsf-impl	4.0.11-2.SP1_redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-log4j	2.25.4-1.redhat_00003.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-neethi	3.2.2-1.redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-netty +14	4.1.136-1.Final_redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-nimbus-jose-jwt	9.37.4-1.redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-parsson	1.1.9-1.redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-saaj-impl +1	3.0.6-1.redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-slf4j +1	2.0.18-1.redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-undertow	2.3.26-2.SP3_redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-wildfly +3	8.1.8-9.GA_redhat_00006.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-wildfly-elytron +1	2.6.11-1.Final_redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-wildfly-javadocs	8.1.1-12.GA_redhat_00048.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8	eap8-ws-commons-XmlSchema	2.3.2-1.redhat_00001.1.el8eap	RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	netty	4.1.138-150200.4.56.1	SUSE-SU-2026:4391-1
SLES 15 SP7	netty-tcnative	2.0.84-150200.3.51.1	SUSE-SU-2026:4391-1
SLES 15 SP6	netty-tcnative	2.0.84-150200.3.51.1	SUSE-SU-2026:4391-1
SLES 15 SP5	netty-tcnative	2.0.84-150200.3.51.1	SUSE-SU-2026:4391-1
SLES 15 SP4	netty-tcnative	2.0.84-150200.3.51.1	SUSE-SU-2026:4391-1

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15 SP6	netty-tcnative	2.0.84-150200.3.51.1	SUSE-SU-2026:4391-1
SLES for SAP 15 SP5	netty-tcnative	2.0.84-150200.3.51.1	SUSE-SU-2026:4391-1
SLES for SAP 15 SP4	netty-tcnative	2.0.84-150200.3.51.1	SUSE-SU-2026:4391-1
SLE HPC 15 SP5	netty-tcnative	2.0.84-150200.3.51.1	SUSE-SU-2026:4391-1
SLE HPC 15 SP4	netty-tcnative	2.0.84-150200.3.51.1	SUSE-SU-2026:4391-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	netty	4.1.138-1.1	openSUSE-SU-2026:11882-1

Advisories 7

WID-SEC-2026-4056 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
WID-SEC-2026-2712 Netty: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
RHSA-2026:70230 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:70229 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:70228 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
SUSE-SU-2026:4391-1 Security update for netty, netty-tcnative SUSE / openSUSE Security Updates · Sep 30, 2026
openSUSE-SU-2026:11882-1 netty-4.1.138-1.1 on GA media SUSE / openSUSE Security Updates · Sep 25, 2026

References

GitHub Security Advisory (GHSA-p85m-gvr3-788c) vendor-advisory
VulnCheck Advisory: Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass third-party-advisory

CNA	v4.0	8.7
CNA	v3.1	7.5
EUVD	v4.0	8.7