CVE-2026-100665: Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass
Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint identification from running even when HTTPS verification is configured. Attackers on the network path can present a certificate chain for the wrong hostname that the plain trust manager accepts, bypassing hostname authentication for QUIC clients.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nettyto a version that resolves this vulnerability.Fixed in 4.2.18.Final
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
QUIC clients using Netty 4.2.11.Final through 4.2.17.Final are exposed when they use a plain X509TrustManager and have HTTPS endpoint identification configured. The affected verification path fails to perform hostname authentication in that configuration.
What does an attacker need to exploit the vulnerability?
The attacker must be on the network path to the QUIC client and be able to present a certificate chain accepted by the client’s plain trust manager for a hostname other than the intended endpoint. No client-side privileges or user interaction are required.
What is the security impact of successful exploitation?
An attacker can bypass hostname authentication for affected QUIC clients, allowing a certificate valid for the wrong hostname to be accepted. The described impact is exposure of confidential information; integrity and availability impacts are not specified.
How can I determine whether a client is affected?
Check whether the application uses Netty QUIC with a plain X509TrustManager and HTTPS endpoint identification, and whether its Netty version is 4.2.11.Final through 4.2.17.Final. Clients outside that version range are not identified as affected by the provided information.