Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-22T12:26:43 io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-295

Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.

A flaw was found in Netty (io.netty:netty-handler). When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping (Java 25+), TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a fraudulent certificate for a different hostname, which is then accepted without proper validation. This could lead to sensitive information disclosure.

Red Hat products ship io.netty:netty-handler as a transitive dependency across multiple middleware and platform products. While the CVSS score reflects the severity of a successful exploit — full confidentiality compromise of TLS-protected traffic without authentication — the vulnerable code path requires three conditions simultaneously: explicit OpenSSL provider configuration, a plain X509TrustManager, and a Java 25+ runtime. Most Red Hat product deployments use the default JDK SSL provider and currently run on Java 21 LTS, making the vulnerable configuration uncommon in practice. This vulnerability only affects applications that explicitly configure Netty to use the OpenSSL TLS provider (SslProvider.OPENSSL). The following mitigations can reduce exposure without applying a patch: 1) Use the default JDK SSL provider — Do not configure SslProvider.OPENSSL in your Netty SslContext setup. The default JDK SSL provider (SslProvider.JDK) is not affected by this vulnerability. Most applications use the JDK default unless explicitly overridden. 2) Use X509ExtendedTrustManager — If the OpenSSL provider is required, ensure the configured trust manager extends X509ExtendedTrustManager rather than the plain X509TrustManager interface. The extended variant performs hostname verification independently of the Netty wrapping logic. 3) Run on Java 24 or earlier — The vulnerable code path only triggers on Java 25+ where sun.misc.Unsafe-based trust-manager wrapping is unavailable. Running on earlier Java versions (e.g., Java 21 LTS) means the wrapping works correctly and hostname verification stays enabled. Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1 2026-09-03T00:00:00Z RHSA-2026:63302 netty-handler Exploit Intelligence Affected exploit-intelligence/agent-client-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-ekb-dispatcher-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-ekb-receiver-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9 Red Hat AMQ Broker 7 Affected netty-handler Red Hat build of Apache Camel 4 for Quarkus 3 Affected netty-handler Red Hat build of Apache Camel for Spring Boot 4 Affected netty-handler Red Hat build of Apicurio Registry 3 Affected netty-handler Red Hat build of Debezium 3 Affected netty-handler Red Hat Build of Keycloak Affected keycloak/rhbk-openshift-rhel9 Red Hat Build of Keycloak Affected keycloak/rhbk-rhel9-operator Red Hat Build of Keycloak Affected netty-handler Red Hat Build of Keycloak Affected rhbk/keycloak-rhel9 Red Hat Build of Keycloak Affected rhbk/keycloak-rhel9-operator Red Hat build of Quarkus Affected netty-handler Red Hat Ceph Storage 6 Fix deferred ceph Red Hat Ceph Storage 7 Fix deferred ceph Red Hat Ceph Storage 8 Fix deferred ceph Red Hat Ceph Storage 9 Fix deferred ceph Red Hat Ceph Storage 9 Fix deferred libarrow Red Hat Data Grid 8 Affected netty-handler Red Hat Enterprise Linux 10 Affected ceph Red Hat Enterprise Linux AI (RHEL AI) 3 Affected bazel6 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected bazel7 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected bazel8 Red Hat Fuse 7 Will not fix netty-handler Red Hat JBoss Enterprise Application Platform 7 Will not fix jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Will not fix jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Will not fix jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Will not fix netty-handler Red Hat JBoss Enterprise Application Platform 8 Affected netty-handler Red Hat JBoss Enterprise Application Platform Expansion Pack Affected netty-handler Red Hat Offline Knowledge Portal Affected offline-knowledge-portal/rhokp-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-modelmesh-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-spark-operator-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th-torch-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th-torch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-service-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/jetbrains-ide-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/multicluster-redirector-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/pluginregistry-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/server-rhel9 Red Hat Satellite 6 Affected candlepin Red Hat Single Sign-On 7 Affected netty-handler https://www.cve.org/CVERecord?id=CVE-2026-62243 https://nvd.nist.gov/vuln/detail/CVE-2026-62243 https://github.com/netty/netty/security/advisories/GHSA-p85m-gvr3-788c https://www.vulncheck.com/advisories/netty-through-tls-hostname-verification-bypass