Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.

CVE-2026-62243 affects Netty (io.netty:netty-handler) versions 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final. The vulnerability disables TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable, specifically in Java 25+ environments. This misconfiguration allows man-in-the-middle (MITM) attackers to present certificates issued for different hostnames that are accepted without validation. The flaw exposes applications using Netty's OpenSSL provider to certificate spoofing and interception of encrypted traffic. Fixed versions are 4.2.17.Final and 4.1.137.Final. Users are strongly advised to upgrade to the patched versions immediately. The vulnerability is particularly significant given Netty's widespread use as a foundational networking library in Java-based enterprise and cloud applications.