CVE-2026-62243High· 7.5▾ TwilightNetty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is use…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-17526High· 7.2Keycloak is an open-source identity and access management solution
CVE-2026-19607Medium· 5.3A flaw was found in the first-broker-login flow of the keycloak-services component
CVE-2026-18212High· 7.5A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution
CVE-2026-74909High· 8.1Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies
CVE-2026-79651High· 7.5A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak
CVE-2026-8763High· 7.4In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI