Netty handler versions 4.2.0.Final through 4.2.16.Final and 4.1.x up to 4.1.136.Final disable TLS hostname verification on the OpenSSL client path when a plain X509TrustManager is used and Unsafe‑based trust‑manager wrapping is unavailable in Java 25+ environments. Without hostname verification, a man‑in‑the‑middle attacker can present a certificate issued for a different hostname and the OpenSSL client will accept it, effectively removing the hostname check from the TLS handshake.

Applications that embed the Netty framework (io.netty:netty‑handler) and use the OpenSSL client implementation of SslHandler with a plain X509TrustManager on Java 25 or newer are affected. The flaw applies specifically to Netty releases 4.2.0.Final‑4.2.16.Final and any 4.1.x version up to 4.1.136.Final.

The CVSS score of 8.7 indicates high severity, while the EPSS score below 1% signifies a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the weakness by establishing a TLS connection that bypasses hostname verification, treating any presented certificate as trusted. This permits full interception, modification, or injection of traffic, and enables delivery of malicious payloads.