CVE-2026-62243 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass
Man-in-the-middle attackers can bypass TLS hostname verification in Netty under specific Java 25+ configurations, accepting invalid certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-62243?
CVE-2026-62243 is a high-severity vulnerability in netty, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.
Weakness: CWE-297
Which versions are affected by CVE-2026-62243?
How do I fix CVE-2026-62243?
Upgrade to a fixed version.
Is CVE-2026-62243 being exploited?
There is no known exploitation of CVE-2026-62243 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-CP08538, CLEANSTART-2026-EA97597, CLEANSTART-2026-EX11941, CLEANSTART-2026-GU46395, CLEANSTART-2026-KB58666, CLEANSTART-2026-PH97070 and 4 more.