Login Request a demo
High severity · published Jun 11, 2026
CVE-2026-44249
Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking
8.1
CVSS
1%
EPSS
No
On KEV
Description
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
netty · netty
>= 4.2.0.Final, < 4.2.15.Final; < 4.1.135.Final · source: vendor, NVD
C4
Cryostat 4 on RHEL 9 · Red Hat
All versions, or not specified · source: CISA
OS
OpenShift Serverless · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat AMQ Clients · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Build of Keycloak · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Fuse 7 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 · Red Hat
All versions, or not specified · source: CISA
Affected product
NE
netty
netty
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44249
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44249
Release Notes
https://github.com/netty/netty/releases/tag/netty-4.1.135.Final
Release Notes
https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
Vendor Advisory
https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:26017
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:26018
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:26586
More from netty
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
10.0
CVE-2026-47691
Netty has Insufficient Bailiwick Validation for NS Records
10.0
CVE-2026-45674
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
9.8
CVE-2026-56817
Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled
9.8
CVE-2026-42581
Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization