Skip to main content

Netty CVE-2026-44249

HIGH
Improper Access Control (CWE-284)
2026-06-08 https://github.com/netty/netty GHSA-3qp7-7mw8-wx86
Authentication Bypass
8.1
CVSS 3.1 · Vendor: https://github.com/netty/netty
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify Netty service exposed over IPv6
  2. Delivery
    Probe whether IpSubnetFilter gates the endpoint
  3. Exploit
    Connect from public IPv6 satisfying flawed mask check
  4. Execution
    Bypass subnet allowlist
  5. Persist
    Access restricted internal endpoint
  6. Impact
    Abuse exposed functionality or data

Vulnerability Assessment

Weakness
CWE
CWE-284
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK

1 technique across 1 tactic: Defense Evasion

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the target application embeds Netty's io.netty.handler.ipfilter.IpSubnetFilterRule (directly or via a framework) and configures at least one IPv6 subnet rule as its access control mechanism; IPv4-only filter configurations are not affected by this specific bug. The attacker must reach the listening port over IPv6 from a public address whose bits happen to align with the networkAddress under the faulty mask computation, which depends on the specific prefix configured by the defender (this drives the CVSS AC:H). No authentication (PR:N) and no user interaction (UI:N) are needed beyond establishing the network connection, and the bug is present in default-shipped IpSubnetFilter logic - there is no opt-in flag to disable.
Impact

The CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects unauthenticated network reachability but elevated attack complexity, which is appropriate since exploitability depends entirely on whether a downstream application uses IpSubnetFilter with IPv6 rules as a security control - a non-default configuration. There is no EPSS score provided, no CISA KEV listing, and no public POC referenced in the data, so this should be treated as a serious latent access-control flaw rather than an imminently exploited threat. Real-world impact is concentrated in deployments where IpSubnetFilter is the sole gatekeeper for privileged endpoints (admin APIs, internal services); for deployments relying on additional authentication or non-IPv6 ACLs, residual risk is materially lower. No conflicting signals were found in the available data.
Exploit ScenarioDerived

An attacker on a public IPv6 network connects to a Netty-based service whose IpSubnetFilter is configured to allow only a specific internal IPv6 prefix; due to the masking bug, the attacker's address from outside that prefix evaluates as 'inside' the allowlist and the connection is accepted. The attacker then interacts with the supposedly restricted endpoint - for example, an administrative API or internal-only RPC - as if originating from a trusted subnet. No POC is referenced in the data, and exploitation requires finding a target that actually applies IpSubnetFilter to IPv6 ranges, which is reflected in the AC:H rating.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 08, 2026

IPv6 access control bypass in Netty's netty-handler component (versions <= 4.1.134.Final and 4.2.0.Final through 4.2.14.Final) allows remote attackers to circumvent IpSubnetFilter restrictions due to a faulty bitwise masking operation in IpSubnetFilterRule.compareTo(). Because the comparator ANDs the incoming IP against the networkAddress instead of the subnetMask, valid public IPv6 addresses outside the configured allowlist/blocklist can pass filter checks. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.

RemediationAI

Vendor-released patch: upgrade io.netty:netty-handler to 4.2.15.Final (https://github.com/netty/netty/releases/tag/netty-4.2.15.Final) on the 4.2.x branch or 4.1.135.Final (https://github.com/netty/netty/releases/tag/netty-4.1.135.Final) on the 4.1.x branch, per GHSA-3qp7-7mw8-wx86. For deployments that cannot upgrade immediately, do not rely on IpSubnetFilter for IPv6 enforcement; enforce IPv6 restrictions one layer up (firewall, reverse proxy such as nginx/HAProxy, cloud security group, or service mesh policy) - the trade-off is duplicated rule management and potential drift between Netty and perimeter ACLs. Alternatively, restrict listeners to IPv4 only (sacrificing IPv6 connectivity) or replace IpSubnetFilter usage with an authenticated identity check, accepting added latency and code change.

Affected Packages

maven io.netty:netty-handler fix: 4.1.135.Final, 4.2.15.Final

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in maven

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Netty is a widely deployed asynchronous event-driven network application framework used by countless Java-based servers, proxies, and microservice runtimes (Spring WebFlux/Reactor, gRPC-Java, Elasticsearch, Cassandra clients, etc.). The defective code lives in io.netty.handler.ipfilter.IpSubnetFilterRule, which implements IP allow/deny lists for connections. CWE-284 (Improper Access Control) applies here because the comparator method intended to compute incomingAddress & subnetMask instead computes incomingAddress & networkAddress, producing incorrect range membership decisions specifically for IPv6 rules. The affected Maven coordinates are pkg:maven/io.netty:netty-handler in both the 4.1.x and 4.2.x branches.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/netty/netty) PRIMARY 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 8.1 HIGH

Primary rating from Vendor (https://github.com/netty/netty).

CVSS VectorVendor: https://github.com/netty/netty

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

Summary

An attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions.

Details

io.netty.handler.ipfilter.IpSubnetFilterRule#compareTo(java.net.InetSocketAddress) method performs a bitwise AND between the incoming IP address and the configured networkAddress, instead of the subnetMask.

Impact

Access Control Bypass. Attacker can bypass IpSubnetFilter IPv6 access controls.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 686 maven packages depend on io.netty:netty-handler (317 direct, 369 indirect)

Ecosystem-wide dependent count for version 4.2.0.Final.

Executive ViewAI

Why It Matters

Netty's netty-handler component (versions 4.1.134.Final and earlier, 4.2.0.Final through 4.2.14.Final) contains a critical IPv6 access control bypass that allows remote attackers to circumvent network filtering rules without authentication. Organizations using Netty to enforce IP-based access controls-particularly those supporting IPv6-face potential unauthorized access to protected resources and systems. Immediate inventory and interim mitigation are required as no vendor patch is currently available.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: enforce IPv6 access controls at the network perimeter (firewall rules, routers) rather than relying solely on application-level filtering; implement enhanced logging and alerting on IPv6 traffic to protected systems; consider IPv6 disablement where operationally feasible; isolate affected Netty instances from untrusted IPv6 sources.

Threat Intelligence Overview

EPSS Score
0.0%
Top 88% exploitable
Threat Intel
1
1 source
Exploit
POC
Public exploit code exists
Data Quality
7 sources
Confidence: High
NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

60
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

pkg:maven/io.netty:netty-handler
pkg:maven/io.netty:netty-handler

Same weakness CWE-284 – Improper Access Control

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

References

Advisories & patches
ADVISORY https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86 ADVISORY https://vuldb.com/vuln/370534 REF https://access.redhat.com/errata/RHSA-2026:26017 REF https://access.redhat.com/errata/RHSA-2026:26018 REF https://access.redhat.com/errata/RHSA-2026:26586 REF https://access.redhat.com/errata/RHSA-2026:28573 REF https://access.redhat.com/errata/RHSA-2026:34608 REF https://access.redhat.com/errata/RHSA-2026:36820 REF https://access.redhat.com/errata/RHSA-2026:37390 REF https://access.redhat.com/errata/RHSA-2026:41951 REF https://access.redhat.com/errata/RHSA-2026:48124 REF https://access.redhat.com/errata/RHSA-2026:48151 REF https://access.redhat.com/errata/RHSA-2026:49700 REF https://access.redhat.com/errata/RHSA-2026:49701 REF https://access.redhat.com/errata/RHSA-2026:50085 REF https://access.redhat.com/errata/RHSA-2026:53644 REF https://access.redhat.com/errata/RHSA-2026:53645 REF https://access.redhat.com/errata/RHSA-2026:53646 REF https://access.redhat.com/errata/RHSA-2026:53806 REF https://access.redhat.com/errata/RHSA-2026:54435 REF https://access.redhat.com/errata/RHSA-2026:65126 REF https://access.redhat.com/errata/RHSA-2026:66488 REF https://access.redhat.com/errata/RHSA-2026:66545 REF https://access.redhat.com/security/cve/CVE-2026-44249 REF https://bugzilla.redhat.com/show_bug.cgi?id=2488081 REF https://github.com/advisories/GHSA-3qp7-7mw8-wx86 REF https://github.com/netty/netty/releases/tag/netty-4.1.135.Final REF https://github.com/netty/netty/releases/tag/netty-4.2.15.Final REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy