CVE-2026-100665

Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass

Assigner: VulnCheck
Reserved: 26.09.2026 Published: 26.09.2026 Updated: 26.09.2026

Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint identification from running even when HTTPS verification is configured. Attackers on the network path can present a certificate chain for the wrong hostname that the plain trust manager accepts, bypassing hostname authentication for QUIC clients.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.7

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 7.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	netty
Product	netty
Versions	Default: unaffected affected from 4.2.11.Final to 4.2.18.Final (excl.) Version 4.2.18.Final is unaffected

Vendor

netty

Product

netty

Versions

Default: unaffected

affected from 4.2.11.Final to 4.2.18.Final (excl.)
Version 4.2.18.Final is unaffected

Credits

rexpository reporter

References

Problem Types