EUVD-2026-117146

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that...

CVE-2026-54372

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that...

CVE-2026-54372

The VitaFit Android application (com.vt.vitafit) before version 2.8.1.0 is vulnerable to insecure TLS/SSL certificate validation. The root cause is a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. This flaw allows network-based attackers to...

PT-2026-137197

Name of the Vulnerable Software and Affected Versions VitaFit Android application versions prior to 2.8.1.0 Description An insecure TLS/SSL certificate validation issue exists due to a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. This...

CVE-2025-50944

CVE-2025-50944 Improper Certificate Chain Validation in EagleEyes Lite Android Application 1. Overview Name : EagleEyesLite Version : 2.0.0 Vendor : AVTECH CWE : CWE-295: Improper Certificate Validation CVSS : 8.8 HIGH Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 2. Summary...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improper Certificate Validation in Netty (CVE-2026-100665)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Improper Certificate Validation in Netty due to an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. Netty is used in our Speech microservices. This vulnerability has...

Hostname Verification Bypass

io.netty, netty-codec-classes-quic is vulnerable to a hostname verification bypass. The vulnerability is due to the improper handling of the SSLEngine by the BoringSSLCertificateVerifyCallback when using a plain X509TrustManager, which allows an attacker positioned on the network path to bypass...

netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager X509TrustManager, it fails to perform...

netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager X509TrustManager, it fails to perform...

netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager X509TrustManager, it fails to perform...

netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager X509TrustManager, it fails to perform...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the verify... method of BoringSSLCertificateVerifyCallback, which for a plain X509TrustManager invokes only the two-argument checkServerTrustedchain, authType overload, dropping the QuicheQuicSslEngine...

CVE-2026-100665

Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint...

UBUNTU-CVE-2026-100665

Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint...

CVE-2026-100665 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass

Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint...

CVE-2026-100665

Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint...

CVE-2026-100665

Netty versions from 4.2.11.Final up to, but before, 4.2.18.Final are vulnerable to a hostname verification bypass in the QUIC certificate verification path. The root cause is that BoringSSLCertificateVerifyCallback discards the SSLEngine when a plain X509TrustManager is used, which prevents endpo...

CVE-2026-100665 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass

Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint...

CVE-2026-100665 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass

Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint...

PT-2026-99336

Name of the Vulnerable Software and Affected Versions Netty versions 4.2.11.Final through 4.2.17.Final Description An incomplete hostname verification fix exists in the QUIC certificate verification path when utilizing a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the...