netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation

🗓️ 20 Jul 2026 11:56:31Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 7 Views

Netty handler flaw bypasses IPv6 subnet rules due to masking error in IpSubnetFilterRule.

Reporter	Title	Published	Views	Family All 182
IBM Security Bulletins	Security Bulletin:Multiple security vulnerabilities in IBM Process Automation Manager Open Edition Starter Kit for Banking	17 Jul 202620:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-handler-4.1.133.Final.jar	30 Jun 202611:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty	25 Jun 202617:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	18 Jun 202606:07	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	7 Jul 202619:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.	22 Jul 202607:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty (CVE-2026-50010,CVE-2026-50020,CVE-2026-45416 & CVE-2026-44249)	10 Jul 202605:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to bypass IPv6 subnet rules due to an incorrect masking.	16 Jul 202603:35	–	ibm
Atlassian	Improper Authorization netty Dependency in Bamboo Data Center	24 Jun 202619:30	–	atlassian
Chainguard	CVE-2026-44249 vulnerabilities	9 Jun 202607:18	–	cgr

Vulners

Node

AND

redhat jboss_data_gridRange<8

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-44249
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/netty/netty/releases/tag/netty-4.1.135.Final
github	www.github.com/netty/netty/releases/tag/netty-4.2.15.Final
github	www.github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-44249
cve	www.cve.org/CVERecord

27 Jul 2026 22:48Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.18.1

EPSS0.00573

SSVC

netty handler subnet rule masking error bypass risk internet protocol version six remote attacker