CVE-2026-100665 netty CVE debrief

Who should care

Defenders responsible for Netty-based applications, especially those using QUIC protocol, should assess exposure and prioritize verification and remediation efforts. This includes operators, platform teams, vulnerability management teams, and security teams who manage or use Netty-based systems.

Why it matters

CVE-2026-100665 is a high-severity vulnerability in Netty versions from 4.2.11.Final before 4.2.18.Final, allowing attackers to bypass hostname authentication for QUIC clients. Defenders should prioritize verifying exposure of Netty-based applications using QUIC protocol and assessing the impact of this vulnerability on their systems.

• Bypassing hostname authentication for QUIC clients
• Potential for attackers to present malicious certificates
• Need for verification of Netty version and QUIC usage
• Priority for updating Netty to version 4.2.18.Final or later

Technical summary

The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint identification from running even when HTTPS verification is configured. This allows attackers on the network path to present a certificate chain for the wrong hostname that the plain trust manager accepts. The vulnerability affects Netty versions from 4.2.11.Final before 4.2.18.Final, specifically in the QUIC certificate verification path when using a plain X509TrustManager. Defenders should prioritize verifying exposure of Netty-based applications using QUIC protocol and assessing the impact of this vulnerability on their systems.

Defensive priority

Defenders should prioritize verifying exposure of Netty-based applications using QUIC protocol and assessing the impact of this vulnerability on their systems.

Recommended defensive actions

• Verify Netty version and QUIC protocol usage in your systems
• Assess exposure of Netty-based applications to this vulnerability
• Update Netty to version 4.2.18.Final or later if vulnerable
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the exact scope of affected systems and versions requires verification from the official sources. Affected systems likely include those using Netty versions from 4.2.11.Final before 4.2.18.Final with QUIC protocol. Defenders should verify Netty version, QUIC usage, and assess exposure of Netty-based applications to this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.