En resumen
- CVE-2026-44249 es una vulnerabilidad ALTO (CVSS 8.1) que afecta a io.netty:netty-handler, netty (netty).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.99%, mayor que el 62.4% de las vulnerabilidades.
- Solución: actualizar a 4.2.15.Final, 4.1.135.Final, 4.2.15, 4.1.135 o posterior.
| Package | Affected versions | Patched versions |
|---|
| io.netty:netty-handler Maven | ≥ 4.2.0.Final, < 4.2.15.Final< 4.1.135.Final
| 4.2.15.Final4.1.135.Final
|
| netty | ≥ 4.2.0, < 4.2.15< 4.1.135
| 4.2.154.1.135
|
Description
Summary
An attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions.
Details
io.netty.handler.ipfilter.IpSubnetFilterRule#compareTo(java.net.InetSocketAddress) method performs a bitwise AND between the incoming IP address and the configured networkAddress, instead of the subnetMask.
Impact
Access Control Bypass. Attacker can bypass IpSubnetFilter IPv6 access controls.
NVD description
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Más vulnerabilidades de io.netty:netty-handler
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free