Netty handler versions 4.2.0.Final through 4.2.16.Final and 4.1.0 through 4.1.136.Final disable TLS hostname verification on the OpenSSL client path when a plain X509TrustManager is used and Unsafe‑based trust‑manager wrapping is unavailable in Java 25+. In this configuration the OpenSSL client does not perform hostname verification, allowing a man‑in‑the‑middle attacker to present a certificate issued for a different hostname that is accepted without validation. This allows compromise of confidentiality and integrity of TLS connections.

Affects the Netty framework (io.netty:netty-handler), specifically those releases. Network services or clients built on these Netty versions using the OpenSSL client implementation of SslHandler and configured with a plain X509TrustManager on Java 25+ are impacted.

The CVSS score of 8.7 indicates a high impact. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog, but attackers can remotely exploit the flaw by establishing a TLS connection that bypasses hostname verification. Because hostname verification is a core part of the TLS handshake, the exploit enables full trust of traffic from rogue hosts, allowing data exfiltration or injection.