CVE-2026-50010 Overview
CVE-2026-50010 is a TLS hostname verification bypass in the Netty network application framework. The flaw resides in SimpleTrustManagerFactory.engineGetTrustManagers() and related code paths, which wrap any user-supplied plain X509TrustManager in an X509TrustManagerWrapper. Because the wrapper extends X509ExtendedTrustManager without correctly implementing endpoint identification, clients built with SslContextBuilder.forClient().trustManager(...) skip hostname verification entirely. The issue affects Netty versions prior to 4.1.135.Final and 4.2.15.Final. The vulnerability is tracked under [CWE-347] Improper Verification of Cryptographic Signature.
Critical Impact
Netty TLS clients silently accept certificates issued for any hostname, exposing applications to man-in-the-middle interception of confidential traffic.
Affected Products
- Netty versions prior to 4.1.135.Final
- Netty versions prior to 4.2.15.Final
- Applications using SslContextBuilder.forClient().trustManager(X509TrustManager)
Discovery Timeline
- 2026-06-12 - CVE-2026-50010 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-50010
Vulnerability Analysis
Netty's SimpleTrustManagerFactory.engineGetTrustManagers() returns trust managers wrapped in an internal X509TrustManagerWrapper. This wrapper extends X509ExtendedTrustManager but implements the 3-argument checkServerTrusted(chain, authType, SSLEngine) method by discarding the SSLEngine and delegating to the 2-argument variant on the underlying X509TrustManager. The discarded SSLEngine is the object that carries the configured endpoint identification algorithm.
Because the returned object already inherits from X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's OpenSslX509TrustManagerWrapper re-wrap it to inject hostname checks. Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, yet that configuration is never consulted at handshake time.
Root Cause
The root cause is an incomplete override of X509ExtendedTrustManager. The wrapper signals support for the extended trust manager contract but does not honor the SSLEngine parameter that drives endpoint identification. This breaks the JSSE assumption that any X509ExtendedTrustManager performs its own hostname validation when the engine's identification algorithm is set.
Attack Vector
An attacker positioned on the network path between the Netty client and its intended server can present any certificate signed by a CA that the client's plain X509TrustManager trusts. The client validates the certificate chain but never checks that the certificate's Subject Alternative Name matches the requested hostname. The attacker then proxies or modifies the TLS-protected traffic. Public Wi-Fi, compromised upstream routers, and DNS hijacking scenarios all enable exploitation. No authentication or user interaction is required, and the attack succeeds against default Netty 4.2 client configurations.
No public proof-of-concept code has been published. Refer to the GitHub Security Advisory GHSA-c653-97m9-rcg9 for technical details from the maintainers.
Detection Methods for CVE-2026-50010
Indicators of Compromise
- TLS sessions established with server certificates whose Subject Alternative Names do not match the connection's target hostname.
- Outbound HTTPS traffic from Netty-based services traversing unexpected intermediate IP addresses or proxies.
- Application logs showing successful TLS handshakes to mismatched hostnames without verification warnings.
Detection Strategies
- Inventory Java applications and identify Netty dependencies below 4.1.135.Final or 4.2.15.Final using Software Composition Analysis tools.
- Audit source code for use of SslContextBuilder.forClient().trustManager(...) paired with custom X509TrustManager implementations.
- Inspect network captures for TLS Client Hello SNI values that do not align with the certificates accepted by Netty clients.
Monitoring Recommendations
- Forward TLS session metadata and certificate fingerprints to a centralized log platform for cross-correlation.
- Alert on unexpected certificate issuers or short-lived certificates observed on connections originating from Netty-based services.
- Monitor egress traffic from servers running affected Netty versions for anomalous destinations that may indicate interception.
How to Mitigate CVE-2026-50010
Immediate Actions Required
- Upgrade Netty to 4.1.135.Final or 4.2.15.Final across all affected applications and rebuild downstream artifacts.
- Identify every SslContextBuilder.forClient().trustManager(...) call site and confirm the trust manager behavior after the upgrade.
- Rotate any credentials or session tokens that may have transited Netty clients on untrusted networks since deployment.
Patch Information
The Netty maintainers fixed the wrapper to correctly delegate the SSLEngine parameter and perform endpoint identification. Patched releases are available at Netty 4.1.135.Final and Netty 4.2.15.Final. Review the GitHub Security Advisory GHSA-c653-97m9-rcg9 for the full advisory.
Workarounds
- Supply an X509ExtendedTrustManager directly instead of a plain X509TrustManager so Netty does not invoke the vulnerable wrapper.
- Configure SSLParameters with endpointIdentificationAlgorithm set to HTTPS and apply them explicitly to each SSLEngine after handshake initialization.
- Restrict outbound TLS connections from affected services to known destinations using egress firewall rules until patching completes.
# Maven dependency upgrade example
mvn versions:set-property -Dproperty=netty.version -DnewVersion=4.1.135.Final
mvn dependency:tree | grep netty
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
