CVE-2026-44249

HIGH

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

Title source: cna
STIX 2.1

Description

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

References (16)

Core 16
Core References

Scores

CVSS v3 8.1
EPSS 0.0057
EPSS Percentile 44.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-1287 CWE-284 CWE-697
Status published
Products (5)
io.netty/netty-handler 0 - 4.1.135.FinalMaven
io.netty/netty-handler 4.2.0.Final - 4.2.15.FinalMaven
netty/netty < 4.1.135
netty/netty < 4.1.135.Final
netty/netty >= 4.2.0.Final, < 4.2.15.Final
Published Jun 11, 2026
Tracked Since Jun 12, 2026