Vulnerability details
CVE-2026-44249
Red Hat OpenShift ServerlessRed Hat AMQ ClientsRed Hat Build of KeycloakRed Hat Enterprise Linux AI 3Red Hat Fuse 7Red Hat JBoss Enterprise Application Platform Expansion Pack
Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking
CVSS 3.1
8.1High
Official description
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.1High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 8.1High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AMQ Clients | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Keycloak | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Keycloak | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Keycloak | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Keycloak | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Fuse 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apicurio Registry 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Debezium 3 | All | CVEProject cvelistV5 (CNA) |
| netty | netty | < 4.1.135.Final | CVEProject cvelistV5 (CNA) |
| netty | netty | >= 4.2.0.Final, < 4.2.15.Final | CVEProject cvelistV5 (CNA) |
References and advisories
26- https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86 x_refsource_CONFIRM
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final x_refsource_MISC
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-44249 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2488081 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:49700 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53644 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53645 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:48151 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53646 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66545 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66488 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26586 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41951 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50085 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:49701 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28573 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65126 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:48124 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37390 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26018 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26017 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34608 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54435 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-06-12
- Last updated
- 2026-09-18
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.98%
Probability of exploitation in 30 days
62.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-284Improper Access Control
- CWE-697Incorrect Comparison
- CWE-1287Improper Validation of Specified Type of Input