Netty versions from 4.2.0.Final through 4.2.16.Final and up to 4.1.136.Final disable TLS hostname verification on the OpenSSL client path when using a plain X509TrustManager and Unsafe-based trust-manager wrapping is unavailable (Java 25+). This allows a man-in-the-middle attacker to present a certificate for a different hostname that is accepted without validation. The issue is fixed in versions 4.2.17.Final and 4.1.137.Final.