CVE-2026-44249

Name of the Vulnerable Software and Affected Versions netty-handler versions prior to 4.1.135.Final netty-handler versions prior to 4.2.15.Final

Description An incorrect masking operation in the compareTo() function of the IpSubnetFilterRule class allows an attacker to bypass IPv6 subnet rules. Specifically, the io.netty.handler.ipfilter.IpSubnetFilterRule#compareTo(java.net.InetSocketAddress) method performs a bitwise AND between the incoming IP address and the configured networkAddress instead of the subnetMask, enabling valid public IP addresses to bypass access controls.

Recommendations Update to version 4.1.135.Final. Update to version 4.2.15.Final.