AIKIDO-2026-421700
netty-handler is vulnerable to Improper Certificate Validation
75
High Risk
This Affects:
netty-handlerTL;DR
Netty's OpenSSL client path adds hostname verification to a plain X509TrustManager by wrapping it, and on the OpenSSL provider that wrapping relies on Unsafe-based reflection. On Java 25 and later Unsafe is unavailable by default, so the wrapping silently fails and the unwrapped trust manager is used, performing no endpoint identification. A client then accepts a certificate valid for the wrong hostname, enabling man-in-the-middle interception. The fix performs hostname verification without depending on Unsafe-based wrapping.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the OpenSSL provider with a plain X509TrustManager on Java 25 or newer.
Background info
netty-handler is vulnerable to Improper Certificate Validation in versions 4.1.0.Final - 4.1.136.Final and 4.2.0.Final - 4.2.16.Final.
How to fix this
Upgrade the io.netty:netty-handler library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.