CVE-2026-44249: Netty Handler IPv6 Subnet Filter Bypass Vulnerability
Summary
CVE-2026-44249: Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking. Affects io.netty:netty-handler across 2 version ranges.
< 4.1.135.Final
>= 4.2.0.Final, < 4.2.15.Final
Fixed in 4.1.135.Final or 4.2.15.Final, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netty is a popular asynchronous event-driven network application framework that enables quick and efficient development of network applications such as protocol servers and clients. The 'netty-handler' package is a core component of Netty, providing essential functionalities for handling network protocols. This package is widely used in various applications for its performance and scalability. However, it is vulnerable to an IPv6 subnet filter bypass due to an incorrect comparator masking operation, which can lead to unauthorized access.
Vulnerability Detail
The vulnerability arises from the method 'io.netty.handler.ipfilter.IpSubnetFilterRule#compareTo(java.net.InetSocketAddress)', which incorrectly performs a bitwise AND operation between the incoming IP address and the configured network address instead of the subnet mask. This flaw allows attackers to bypass IPv6 access controls, potentially leading to unauthorized access to restricted resources. The impact is significant as it can compromise the security of applications relying on Netty for network communication.
How To Fix
Latest published version: 5.0.0.Alpha2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.1.135.Final4.1.135.Final -
>= 4.2.0.Final, < 4.2.15.Final4.2.15.Final
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing additional access control measures at the application level to mitigate the risk of unauthorized access until the package can be updated. This may include validating incoming IP addresses against a whitelist or implementing stricter authentication mechanisms.
Conclusion
The CVE-2026-44249 vulnerability in the Netty 'netty-handler' package poses a significant risk due to its ability to bypass IPv6 access controls. It is crucial for developers to update to the patched versions to ensure the security of their applications. Implementing additional access control measures can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for io.netty:netty-handler →
FAQ
CVE-2026-44249 is a vulnerability in the Netty 'netty-handler' package that allows attackers to bypass IPv6 subnet filter rules due to incorrect comparator masking.
If your application uses the affected version of Netty, it may allow unauthorized users to access restricted resources, compromising security.
Versions of 'netty-handler' up to 4.2.14.Final and 4.1.134.Final are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.netty:netty-handler.
