Netty versions from 4.2.11.Final up to but not including 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. This flaw allows attackers on the network path to bypass hostname authentication by presenting a certificate chain for a wrong hostname that the trust manager accepts. The vulnerability has a CVSS score of 7.5, indicating a medium severity level.