Netty's IpSubnetFilterRule.compareTo() method contains an incorrect masking operation that leads to a CWE-1287 weak request validation flaw; as a result, attackers can craft IPv6 packets that satisfy subnet checks even when they are not in the defined subnet. This flaw allows valid public IPv6 addresses to bypass the intended IP-based access controls, enabling malicious traffic to reach services that would otherwise be blocked.

The vulnerability exists in the netty-handler component of the Netty framework. Versions of Netty before 4.1.135.Final in the 4.1.x branch and before 4.2.15.Final in the 4.2.x branch are affected. Any application that includes the vulnerable Netty library and relies on Netty for IPv6 subnet filtering is at risk. The responsible vendor is the open‑source Netty project.

The flaw carries a CVSS score of 8.1, signifying high severity. The EPSS score is 0.00039 (<1%), and the issue is not listed in CISA KEV. The likely attack vector is network‑based: an attacker can send specially crafted IPv6 packets from any public address to a target that applies Netty’s subnet filtering, thereby gaining unauthorized access to services protected by the framework’s subnet rules.