En bref
- CVE-2026-44249 est une vulnérabilité ÉLEVÉE (CVSS 8.1) touchant io.netty:netty-handler, netty (netty).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.99%, plus élevée que 62.4% des vulnérabilités.
- Correctif : mettre à jour vers 4.2.15.Final, 4.1.135.Final, 4.2.15, 4.1.135 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| io.netty:netty-handler Maven | ≥ 4.2.0.Final, < 4.2.15.Final< 4.1.135.Final
| 4.2.15.Final4.1.135.Final
|
| netty | ≥ 4.2.0, < 4.2.15< 4.1.135
| 4.2.154.1.135
|
Description
Summary
An attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions.
Details
io.netty.handler.ipfilter.IpSubnetFilterRule#compareTo(java.net.InetSocketAddress) method performs a bitwise AND between the incoming IP address and the configured networkAddress, instead of the subnetMask.
Impact
Access Control Bypass. Attacker can bypass IpSubnetFilter IPv6 access controls.
NVD description
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Autres vulnérabilités de io.netty:netty-handler
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free