Description
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Metrics
CVSS 3.1 8.1/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| netty | netty | >= 4.2.0.Final, < 4.2.15.Final; < 4.1.135.Final |
| Red Hat | Cryostat 4 on RHEL 9 | — |
| Red Hat | Cryostat 4 on RHEL 9 | — |
| Red Hat | Cryostat 4 on RHEL 9 | — |
| Red Hat | Red Hat AMQ Broker 7.13.6 | — |
| Red Hat | Red Hat AMQ Broker 7.14.1 | — |
| Red Hat | Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1 | — |
| Red Hat | Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 | — |
| Red Hat | Red Hat build of Quarkus 3.27.4.SP1 | — |
| Red Hat | Red Hat build of Quarkus 3.33.2.SP1 | — |
| Red Hat | Red Hat Data Grid 8.6.2 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | — |
References
- https://github.com/netty/netty/releases/tag/netty-4.1.135.FinalRelease Notes
- https://github.com/netty/netty/releases/tag/netty-4.2.15.FinalRelease Notes
- https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:26017
- https://access.redhat.com/errata/RHSA-2026:26018
- https://access.redhat.com/errata/RHSA-2026:26586
- https://access.redhat.com/errata/RHSA-2026:28573
- https://access.redhat.com/errata/RHSA-2026:34608
- https://access.redhat.com/errata/RHSA-2026:36820
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:48124
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:49700
- https://access.redhat.com/errata/RHSA-2026:49701
- https://access.redhat.com/errata/RHSA-2026:50085
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:54435
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:66488
- https://access.redhat.com/errata/RHSA-2026:66545
- https://access.redhat.com/security/cve/CVE-2026-44249
- https://bugzilla.redhat.com/show_bug.cgi?id=2488081
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json
Timeline
- Published
- Jun 11, 2026
- Last modified
- Sep 18, 2026
- NVD status
- Modified