Netty 4.2.11.Final to 4.2.17.Final contain an incomplete hostname verification routine in the QUIC certificate path when a plain X509TrustManager is used. The callback discards the SSLEngine required for endpoint identification, causing the hostname check to be skipped even when HTTPS verification is configured. This flaw allows an attacker to supply a certificate chain for an unintended hostname that the plain trust manager accepts, resulting in a man‑in‑the‑middle attack that bypasses authentication and can expose confidential data or impersonate the server.

Any application that incorporates Netty versions 4.2.11.Final through 4.2.17.Final and utilizes the QUIC protocol with a vanilla X509TrustManager is affected. Projects that depend on these Netty releases for client or server QUIC communication must verify their version and configuration.

The likely attack vector is an attacker on the network path manipulating the TLS handshake to present a forged certificate chain for the wrong hostname. The vulnerability operates purely on the network layer and does not require local privileges, enabling a remote attacker who can observe or modify traffic to the QUIC endpoint to bypass hostname authentication. The CVSS score is 8.7, EPSS data are unavailable, and the vulnerability is not listed in CISA's KEV catalog.