Search: CVE-2026-50010

Netty versions prior to 4.1.135.Final and 4.2.15.Final contain a vulnerability in the SimpleTrustManagerFactory.engineGetTrustManagers() method. This flaw causes user-supplied plain X509TrustManager instances to be wrapped improperly, resulting in the omission of hostname verification despite the default setting of endpointIdentificationAlgorithm="HTTPS". This means clients using certain custom trust managers may not perform hostname verification, potentially allowing man-in-the-middle attacks. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final.