Log in Start free

Vulnerability · Published Jun 11, 2026 · Assigned by GitHub_M

CVE-2026-44249Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

High 8.1

In plain English

A high-severity improper access control in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)1.0%top 37.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nettyno fix listedDEBIAN-CVE-2026-44249
Debian:13nettyno fix listedDEBIAN-CVE-2026-44249
Debian:14nettyno fix listedDEBIAN-CVE-2026-44249
Mavenio.netty:netty-handler4.1.135.FinalGHSA-3qp7-7mw8-wx86
Mavenio.netty:netty-handler4.2.15.FinalGHSA-3qp7-7mw8-wx86
Ubuntu:25.10nettyno fix listedUBUNTU-CVE-2026-44249
Ubuntu:26.10nettyno fix listedUBUNTU-CVE-2026-44249

Affected products (as reported)

VendorProductVersions
netty netty >= 4.2.0.Final, < 4.2.15.Final< 4.1.135.Final

Weakness: CWE-284, CWE-697, CWE-1287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References