CVE-2026-50010
CVE-2026-50010 · Netty's wrapping plain trust manager silently disables hostname verification
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
CVSS 7.5 · High · EPSS 0.5%
- Published
- Updated
Stack: system
Affected products and versions
netty
- Versions
- >= 4.2.0.Final, < 4.2.15.Final: Affected
- < 4.1.135.Final: Affected
No fix published
netty Debian:12
- Versions
- 1:4.1.48-10
- 1:4.1.48-11
- 1:4.1.48-12
- 1:4.1.48-13
- 1:4.1.48-14
- 1:4.1.48-15
- 1:4.1.48-16
- 1:4.1.48-7
- 1:4.1.48-7+deb12u1
- 1:4.1.48-7+deb12u2
- 1:4.1.48-8
- 1:4.1.48-9
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Debian:13
- Versions
- 1:4.1.48-10
- 1:4.1.48-10+deb13u1
- 1:4.1.48-11
- 1:4.1.48-12
- 1:4.1.48-13
- 1:4.1.48-14
- 1:4.1.48-15
- 1:4.1.48-16
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Debian:14
- Versions
- 1:4.1.48-10
- 1:4.1.48-11
- 1:4.1.48-12
- 1:4.1.48-13
- 1:4.1.48-14
- 1:4.1.48-15
- 1:4.1.48-16
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:14.04:LTS
- Versions
- 1:3.2.6.Final-2
- 1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1
- 1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:16.04:LTS
- Versions
- 1:3.2.6.Final-2
- 1:4.0.32-1
- 1:4.0.33-1
- 1:4.0.34-1
- 1:4.0.34-1ubuntu0.1~esm1
- 1:4.0.34-1ubuntu0.1~esm2
- 1:4.0.34-1ubuntu0.1~esm3
- 1:4.0.34-1ubuntu0.1~esm4
- 1:4.0.34-1ubuntu0.1~esm5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:18.04:LTS
- Versions
- 1:4.1.7-4
- 1:4.1.7-4ubuntu0.1~esm1
- 1:4.1.7-4ubuntu0.1
- 1:4.1.7-4ubuntu0.1+esm1
- 1:4.1.7-4ubuntu0.1+esm2
- 1:4.1.7-4ubuntu0.1+esm3
- 1:4.1.7-4ubuntu0.1+esm4
- 1:4.1.7-4ubuntu0.1+esm5
- 1:4.1.7-4ubuntu0.1+esm6
- 1:4.1.7-4ubuntu0.1+esm7
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:20.04:LTS
- Versions
- 1:4.1.33-1
- 1:4.1.33-2
- 1:4.1.33-3
- 1:4.1.45-1
- 1:4.1.45-1ubuntu0.1~esm1
- 1:4.1.45-1ubuntu0.1~esm2
- 1:4.1.45-1ubuntu0.1~esm3
- 1:4.1.45-1ubuntu0.1~esm4
- 1:4.1.45-1ubuntu0.1~esm6
- 1:4.1.45-1ubuntu0.1~esm7
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:22.04:LTS
- Versions
- 1:4.1.48-4
- 1:4.1.48-4+deb11u1build0.22.04.1
- 1:4.1.48-4+deb11u2build0.22.04.1
- 1:4.1.48-4+deb11u2ubuntu0.1~esm1
- 1:4.1.48-4+deb11u2ubuntu0.1~esm2
- 1:4.1.48-4+deb11u2ubuntu0.1
- 1:4.1.48-4+deb11u2ubuntu0.1+esm1
- 1:4.1.48-4+deb11u2ubuntu0.1+esm3
- 1:4.1.48-4+deb11u2ubuntu0.2
- 1:4.1.48-4+deb11u2ubuntu0.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:24.04:LTS
- Versions
- 1:4.1.48-7
- 1:4.1.48-8
- 1:4.1.48-9
- 1:4.1.48-9ubuntu0.1~esm1
- 1:4.1.48-9ubuntu0.1~esm2
- 1:4.1.48-9ubuntu0.1
- 1:4.1.48-9ubuntu0.1+esm1
- 1:4.1.48-9ubuntu0.1+esm3
- 1:4.1.48-9ubuntu0.2
- 1:4.1.48-9ubuntu0.2+esm1
- 1:4.1.48-9ubuntu0.2+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:25.10
- Versions
- 1:4.1.48-10
- 1:4.1.48-10ubuntu0.25.10.1
- 1:4.1.48-10ubuntu0.25.10.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:26.10
- Versions
- 1:4.1.48-16
- 1:4.1.48-16ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:26.04:LTS
- Versions
- 1:4.1.48-10
- 1:4.1.48-11
- 1:4.1.48-12
- 1:4.1.48-13
- 1:4.1.48-14
- 1:4.1.48-16
- 1:4.1.48-16ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
- https://access.redhat.com/security/cve/CVE-2026-50010
- https://bugzilla.redhat.com/show_bug.cgi?id=2488429
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50010.json
- https://access.redhat.com/errata/RHSA-2026:49700
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:66545
- https://access.redhat.com/errata/RHSA-2026:66488
- https://access.redhat.com/errata/RHSA-2026:26586
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:50085
- https://access.redhat.com/errata/RHSA-2026:49701
- https://access.redhat.com/errata/RHSA-2026:28573
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:62260
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/errata/RHSA-2026:26018
- https://access.redhat.com/errata/RHSA-2026:26017
- https://nvd.nist.gov/vuln/detail/CVE-2026-50010