CVE-2026-62243

Netty (io.netty:netty-handler) versions 4.2.0.Final through 4.2.16.Final and through 4.1.136.Final contain a TLS hostname verification bypass on the SslProvider.OPENSSL client path. When a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 2...

CVE-2026-62243

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

CVE-2026-62380

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-62243 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

CVE-2026-62380 Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-62243 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

CVE-2026-62380 Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-62380 Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

EUVD-2026-64272

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-62243 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

CVE-2026-62243

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

CVE-2026-62380

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-62380

Netty (io.netty:netty-codec-socks) versions 4.1.x through 4.1.136.Final and 4.2.0.Final through 4.2.16.Final contain null byte and CRLF injection vulnerabilities in the Socks4ClientEncoder and Socks5ClientEncoder . The encoders fail to validate domain address and authentication (username/password...

PT-2026-79546

Name of the Vulnerable Software and Affected Versions Netty io.netty:netty-handler versions 4.2.0.Final through 4.2.16.Final Netty io.netty:netty-handler versions prior to 4.1.137.Final Description TLS hostname verification is disabled on the SslProvider.OPENSSL client path when a plain...

CVE-2026-62380: Null Byte Interaction Error (Poison Null Byte)

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

PT-2026-79547

Name of the Vulnerable Software and Affected Versions Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final Netty io.netty:netty-codec-socks versions 4.1.x through 4.1.136.Final Description Null byte, CRLF, and credential injection issues exist in the SOCKS4 Socks4ClientEncod...

CVE-2026-62243: Improper Validation of Certificate with Host Mismatch

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

Linux Distros Unpatched Vulnerability : CVE-2026-62243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the...

Linux Distros Unpatched Vulnerability : CVE-2026-62380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection...

CVE-2026-73507

A flaw was found in Netty's XmlFrameDecoder component. An unauthenticated remote attacker could send specially crafted XML closing-tag sequences. This could cause the system to repeatedly rescan accumulated data, leading to high CPU utilization and a denial of service DoS. Mitigation Red Hat...