Description

Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint identification from running even when HTTPS verification is configured. Attackers on the network path can present a certificate chain for the wrong hostname that the plain trust manager accepts, bypassing hostname authentication for QUIC clients.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-26T14:16:49.677Z",
  "pubdate": "2026-09-26T14:16:49.677Z",
  "executiveSummary": "Netty versions ranging from 4.2.11.Final through 4.2.17.Final contain a critical vulnerability in the QUIC protocol certificate verification path. The issue stems from an incomplete hostname verification implementation within the BoringSSLCertificateVerifyCallback mechanism. When utilizing a plain X509TrustManager, the system improperly discards the SSLEngine context, which serves as the prerequisite for successful endpoint identification.\nThis failure effectively disables hostname validation, even when explicitly configured for HTTPS. The vulnerability presents a significant security risk by allowing an adversary positioned on the network path to perform Man-in-the-Middle (MitM) attacks. By presenting an arbitrary or unauthorized certificate chain, an attacker can impersonate a legitimate service, leading to the interception or manipulation of encrypted traffic.\nExploitation does not require authentication or elevated privileges, provided the attacker can intercept or redirect network traffic between the client and the intended server. The vulnerability primarily affects QUIC-enabled clients relying on Netty's BoringSSL integration. Organizations using these versions should prioritize upgrading to version 4.2.18.Final or later to restore proper identity verification and maintain transport layer integrity.",
  "technicalDetails": "The vulnerability is located within the BoringSSLCertificateVerifyCallback component of the Netty QUIC implementation. The root cause is a logic error during the SSL handshake process: when a plain X509TrustManager is initialized, the implementation incorrectly drops the reference to the SSLEngine. In the Netty/BoringSSL architecture, the SSLEngine is essential for carrying out endpoint identification—the procedure that ensures the hostname presented in the certificate matches the identity of the server requested by the client.\nBecause the SSLEngine is discarded prematurely, the standard HTTPS verification logic is never triggered or is rendered incapable of executing the necessary checks against the server identity. Consequently, the X509TrustManager only validates the validity of the certificate chain (e.g., signature verification and expiration) but fails to perform the crucial step of validating the Subject Alternative Name (SAN) or Common Name (CN) against the target hostname.\nThe attack flow proceeds as follows: 1) An attacker intercepts a QUIC connection attempt initiated by a Netty-based client. 2) During the TLS/QUIC handshake, the attacker presents a certificate that is cryptographically valid (signed by a trusted CA or otherwise accepted by the trust manager) but issued for a hostname controlled by the attacker rather than the legitimate target. 3) The Netty BoringSSLCertificateVerifyCallback evaluates the certificate using the plain X509TrustManager, which validates the chain but ignores the hostname mismatch due to the loss of SSLEngine context. 4) The client proceeds with the connection under the false assumption that the remote endpoint is authentic, allowing the attacker to intercept sensitive data, inject traffic, or execute man-in-the-middle operations.\nThis vulnerability is present in versions 4.2.11.Final to 4.2.17.Final. It is not dependent on the server's configuration but rather on the client's failure to enforce identity verification during the handshake. The impact is a complete bypass of hostname authentication, undermining the security guarantees provided by the QUIC transport layer and exposing the application to data theft and impersonation."
}