🚨 High - Netty TLS Hostname Verification Bypass (CVE-2026-50010) SimpleTrustManagerFactory in Netty wraps custom X509TrustManager instances in a way that silently disables hostname verification - even when Netty 4.2's endpointIdentificationAlgorithm=HTTPS default is active. An attacker on the network path can perform a man-in-the-middle attack against any TLS connection using the affected factory, with no privileges required (CVSS 7.5). 👉 Affected: io.netty:netty-handler ≥ http://4.2.0.Final < http://4.2.15.Final and < http://4.1.135.Final | Upgrade to http://4.2.15.Final / http://4.1.135.Final
Post summary
The tweet discloses a Netty TLS hostname verification bypass (CVE-2026-50010) that allows MITM attacks without privileges, and recommends upgrading to specific patched versions.
