CVE-2026-100665 Details
Description
Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint identification from running even when HTTPS verification is configured. Attackers on the network path can present a certificate chain for the wrong hostname that the plain trust manager accepts, bypassing hostname authentication for QUIC clients.
A vulnerability exists in Netty versions 4.2.11.Final prior to 4.2.18.Final, allowing QUIC clients to bypass hostname verification when using a plain X509TrustManager. This issue arises because the BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing proper endpoint identification even when HTTPS verification is enabled. As a result, attackers can present a certificate chain for an incorrect hostname that the plain trust manager accepts, undermining hostname authentication for QUIC clients.
Users can upgrade to Netty version 4.2.18.Final or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Oct 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387 | CISA-ADP | AdvisoryExploitTechnical Analysis |
| https://github.com/netty/netty/commit/09e72c4fd8007277121ed48db63a124b112b96fe | [email protected] | Source CodeVendor |
| https://github.com/netty/netty/commit/994e887ed9 | [email protected] | Source CodeVendor |
| https://github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387 | [email protected] | AdvisoryExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/netty-4.2.11-through-4.2.17-quic-hostname-verification-bypass | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Netty | >= 4.2.11.Final, < 4.2.18.Final |
CPE
Remediation
| |
| Netty codec-classes-quic | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 2, 2026 | CVE Modified | CISA-ADP |
| Sep 27, 2026 | CVE Modified | [email protected] |
| Sep 26, 2026 | New CVE Received | [email protected] |