Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100665Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass

High 7.5

In plain English

A high-severity improper certificate validation in netty from netty. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 69.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint identification from running even when HTTPS verification is configured. Attackers on the network path can present a certificate chain for the wrong hostname that the plain trust manager accepts, bypassing hostname authentication for QUIC clients.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:26.10	netty	no fix listed	UBUNTU-CVE-2026-100665

Affected products (as reported)

Vendor	Product	Versions
netty	netty	4.2.11.Final – before 4.2.18.Final

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-mj35-3qqm-q387) vendor-advisory
Patch Commit patch
Patch Commit patch
VulnCheck Advisory: Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass third-party-advisory