CVE-2026-50010

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.135.Final Netty versions prior to 4.2.15.Final

Description Netty is a network application framework used for developing protocol servers and clients. The SimpleTrustManagerFactory.engineGetTrustManagers() function and related paths wrap user-supplied plain X509TrustManager in X509TrustManagerWrapper. This wrapper extends X509ExtendedTrustManager but implements the 3-argument checkServerTrusted(chain, authType, SSLEngine) function by discarding the SSLEngine and calling the 2-argument delegate. Because the object is identified as an X509ExtendedTrustManager, internal wrappers from SunJSSE or Netty do not re-wrap it to add endpoint-identification. This results in a failure to perform hostname verification when a client is built using SslContextBuilder.forClient().trustManager(somePlainX509TrustManager), even if endpointIdentificationAlgorithm is set to "HTTPS" by default, potentially enabling man-in-the-middle attacks.

Recommendations Update to version 4.1.135.Final. Update to version 4.2.15.Final.