CVE-2026-44249: Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking
Summary An attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions.
Details io.netty.handler.ipfilter.IpSubnetFilterRule#compareTo(java.net.InetSocketAddress) method performs a bitwise AND between the incoming IP address and the configured networkAddress, instead of the subnetMask.
Impact Access Control Bypass. Attacker can bypass IpSubnetFilter IPv6 access controls.
Other sources
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty:netty-handlerto a version that resolves this vulnerability.Fixed in 4.1.135.Final - Upgrade
Upgrade
maven/io.netty:netty-handlerto a version that resolves this vulnerability.Fixed in 4.2.15.Final - Upgrade
Upgrade
netty-handlerto a version that resolves this vulnerability.Fixed in 4.1.135.Final - Upgrade
Upgrade
netty-handlerto a version that resolves this vulnerability.Fixed in 4.2.15.Final
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44249?
CVE-2026-44249 has a severity score of 8.1, indicating a high risk.
What does CVE-2026-44249 entail?
CVE-2026-44249 allows attackers to bypass IPv6 subnet rules due to an incorrect masking operation.
Which software is affected by CVE-2026-44249?
CVE-2026-44249 affects the Maven package io.netty:netty-handler.
How do I fix CVE-2026-44249?
To mitigate CVE-2026-44249, update to the latest version of Netty that addresses this vulnerability.
What impact does CVE-2026-44249 have on security?
CVE-2026-44249 can lead to unauthorized access since valid public IP addresses can bypass subnet restrictions.