CVE-2026-100665

Name of the Vulnerable Software and Affected Versions Netty versions 4.2.11.Final through 4.2.17.Final

Description An incomplete hostname verification fix exists in the QUIC certificate verification path when utilizing a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, which prevents endpoint identification from executing even if HTTPS verification is configured. This allows network attackers to present a certificate chain for an incorrect hostname that the plain trust manager accepts, effectively bypassing hostname authentication for QUIC clients.

Recommendations Update Netty to version 4.2.18.Final.