CVE-2026-44249
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
In Netty library versions prior to 4.1.135.Final and 4.2.15.Final, a vulnerability was found in the IpSubnetFilterRule class where an incorrect masking operation in the compareTo() method allows bypassing IPv6 subnet filtering rules. An attacker can exploit this flaw to access resources protected by subnet rules.
Risk Assessment
The risk is that an attacker with a public IPv6 address can bypass network security based on subnet rules, potentially leading to unauthorized access to servers or services protected by Netty.
Recommendation
Immediately update the netty-handler library to version 4.1.135.Final or 4.2.15.Final, which contain the fix for this vulnerability.
Original NVD description (English source)
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.