This vulnerability (CVE-2026-62243) affects Netty's io.netty:netty-handler library in versions 4.2.0.Final through 4.2.16.Final and versions up to 4.1.136.Final. When using the OpenSSL client path with a plain (non-extended) X509TrustManager and Unsafe-based trust-manager wrapping is unavailable (notably on Java 25+), TLS hostname verification is disabled. Consequently, the OpenSSL client does not verify that the server certificate matches the hostname, enabling a man-in-the-middle attacker to present a certificate issued for a different hostname that will be accepted without validation. This flaw is addressed in versions 4.2.17.Final and 4.1.137.Final.

The vulnerability allows an attacker positioned as a man-in-the-middle to bypass TLS hostname verification, potentially intercepting or manipulating encrypted communications without detection. Confidentiality is impacted (high impact on confidentiality), but integrity and availability are not directly affected according to the CVSS vector.

Upgrade to Netty versions 4.2.17.Final or later, or 4.1.137.Final or later, where this issue is fixed. There is no indication that other mitigations or workarounds are available or recommended. Patch status is confirmed by the vendor advisory stating the fix versions.