CVE-2026-50010High· 7.5▾ TwilightNetty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.5%
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with SslContextBuilder.forClient().trustManager(somePlainX509TrustManager) performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
netty < 4.1.135netty >= 4.2.0, < 4.2.15Upgrade past the affected range:
netty 4.2.15Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44248Medium· 5.3Netty is an asynchronous, event-driven network application framework
CVE-2026-42584High· 7.3Netty is an asynchronous, event-driven network application framework
CVE-2026-42581Medium· 5.8Netty is an asynchronous, event-driven network application framework
CVE-2026-42579High· 7.5Netty is an asynchronous, event-driven network application framework
CVE-2026-42578High· 7.5Netty is an asynchronous, event-driven network application framework
CVE-2026-44250High· 7.5Netty is a network application framework for development of protocol servers and clients