CyberRota Analysis
AI-GeneratedVersions of Netty from 4.2.0.Final to 4.2.16.Final and 4.1.136.Final are vulnerable due to the disabling of TLS hostname verification when using a plain X509TrustManager with the OpenSSL client path. This flaw allows a man-in-the-middle attacker to exploit the lack of hostname validation, potentially leading to unauthorized access or data interception. Organizations utilizing affected Netty versions, particularly those handling sensitive data or communications, should prioritize upgrading to versions 4.2.17.Final or 4.1.137.Final to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.