Bug#1145167: netty: CVE-2026-62243 CVE-2026-62380

[Salvatore Bonaccorso]

Source: netty
Version: 1:4.1.48-16
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerabilities were published for netty.

CVE-2026-62243[0]:
| Netty (io.netty:netty-handler) versions from 4.2.0.Final through
| 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname
| verification on the SslProvider.OPENSSL client path when a plain
| (non-extended) X509TrustManager is used and Unsafe-based trust-
| manager wrapping is unavailable (Java 25+). In this configuration
| the OpenSSL client does not perform hostname verification, allowing
| a man-in-the-middle attacker to present a certificate issued for a
| different hostname that is accepted without validation. Fixed in
| 4.2.17.Final and 4.1.137.Final.


CVE-2026-62380[1]:
| Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through
| 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte,
| CRLF, and credential injection vulnerabilities in the SOCKS4
| (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client
| encoders, which fail to validate domain address and authentication
| (username/password) fields. An attacker able to control these fields
| can inject null bytes or CRLF characters to truncate or alter
| values, potentially enabling domain spoofing, SOCKS4 userid
| truncation, authentication data injection, and protocol confusion.
| Fixed in 4.2.17.Final and 4.1.137.Final.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-62243
    https://www.cve.org/CVERecord?id=CVE-2026-62243
[1] https://security-tracker.debian.org/tracker/CVE-2026-62380
    https://www.cve.org/CVERecord?id=CVE-2026-62380

Regards,
Salvatore