CVE-2026-50010: Hostname Verification Bypass in Netty TLS Client

Vulnerability ID: CVE-2026-50010
CVSS Score: 7.5
Published: 2026-06-15

A critical hostname verification bypass vulnerability exists in the Netty network application framework when configured as a TLS client. When a developer registers a custom plain X509TrustManager, Netty wraps it inside an X509TrustManagerWrapper to adapt it to the X509ExtendedTrustManager API. However, this wrapper discards the SSLEngine context, bypassing critical hostname checks. Because the wrapper is identified as an X509ExtendedTrustManager, standard cryptographic engines and Netty's OpenSSL wrappers do not re-wrap it, failing to execute any hostname validation. Consequently, clients silently accept certificates for any host, enabling unauthenticated Man-in-the-Middle (MitM) attacks.

TL;DR

Netty silently bypasses TLS hostname verification when custom plain X509TrustManagers are used, exposing clients to unauthenticated Man-in-the-Middle (MitM) traffic interception.

Technical Details

• CWE ID: CWE-347 (Improper Verification of Cryptographic Signature)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• CVSS v3.1 Score: 7.5 (High)
• EPSS Score: 0.00196 (0.20% probability of exploit in next 30 days)
• Exploit Status: None / Unweaponized
• CISA KEV Status: Not Listed

Affected Systems

• Netty Client Configurations
• Java Applications using Netty-Handler with custom trust managers
• netty-handler: < 4.1.135.Final (Fixed in: 4.1.135.Final)
• netty-handler: >= 4.2.0.Final, < 4.2.15.Final (Fixed in: 4.2.15.Final)

Mitigation Strategies

• Upgrade the Netty library to a patched version (4.1.135.Final or 4.2.15.Final).
• Refactor custom trust managers to explicitly extend X509ExtendedTrustManager and perform manual hostname verification.
• Inject a post-handshake ChannelHandler to programmatically verify the peer certificate hostname.
• Implement network-level segmentation or mTLS proxies to secure transit paths.

Remediation Steps:

1. Identify all direct and transitive dependencies on netty-handler within the project build files (e.g., pom.xml or build.gradle).
2. Update the Netty version property to 4.1.135.Final (for 4.1.x) or 4.2.15.Final (for 4.2.x).
3. Audit custom usage of SslContextBuilder.forClient().trustManager(...) to verify whether plain X509TrustManager implementations are passed.
4. Where custom plain trust managers are used, refactor them to extend X509ExtendedTrustManager.
5. Rebuild the application and deploy to staging environments for TLS handshake verification testing.
6. Run automated vulnerability scanning to confirm the absence of vulnerable Netty jars.

References

• Official Netty Security Advisory (GHSA-c653-97m9-rcg9)
• Netty 4.1.135.Final Release Notes
• Netty 4.2.15.Final Release Notes
• CVE.org Record
• Wiz Vulnerability Database Analysis

Read the full report for CVE-2026-50010 on our website for more details including interactive diagrams and full exploit analysis.