Source: netty Version: 1:4.1.48-16 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for netty. CVE-2026-62243[0]: | Netty (io.netty:netty-handler) versions from 4.2.0.Final through | 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname | verification on the SslProvider.OPENSSL client path when a plain | (non-extended) X509TrustManager is used and Unsafe-based trust- | manager wrapping is unavailable (Java 25+). In this configuration | the OpenSSL client does not perform hostname verification, allowing | a man-in-the-middle attacker to present a certificate issued for a | different hostname that is accepted without validation. Fixed in | 4.2.17.Final and 4.1.137.Final. CVE-2026-62380[1]: | Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through | 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, | CRLF, and credential injection vulnerabilities in the SOCKS4 | (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client | encoders, which fail to validate domain address and authentication | (username/password) fields. An attacker able to control these fields | can inject null bytes or CRLF characters to truncate or alter | values, potentially enabling domain spoofing, SOCKS4 userid | truncation, authentication data injection, and protocol confusion. | Fixed in 4.2.17.Final and 4.1.137.Final. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-62243 https://www.cve.org/CVERecord?id=CVE-2026-62243 [1] https://security-tracker.debian.org/tracker/CVE-2026-62380 https://www.cve.org/CVERecord?id=CVE-2026-62380 Regards, Salvatore
