Netty: Wrapping plain trust manager silently disables hostname verification

高 7.5CVE-2026-50010 · GHSA-c653-97m9-rcg9 · 12/06/2026 公開 · 18/09/2026 更新

要点

CVE-2026-50010 は io.netty:netty-handler, netty (netty) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.49%（全脆弱性の 42.2% より高い）。
対処：4.2.15.Final, 4.1.135.Final, 4.2.15, 4.1.135 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
io.netty:netty-handler Maven	`≥ 4.2.0.Final, < 4.2.15.Final< 4.1.135.Final`	`4.2.15.Final4.1.135.Final`
netty netty	`≥ 4.2.0, < 4.2.15< 4.1.135`	`4.2.154.1.135`

概要

SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with SslContextBuilder.forClient().trustManager(somePlainX509TrustManager) performs no hostname verification at all.

NVD の説明

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.