CVE-2026-44249 — Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

Affected: netty, Red Hat Cryostat 4 on RHEL 9, Red Hat AMQ Broker 7.13.6, Red Hat AMQ Broker 7.14.1, Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1, Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16, Red Hat build of Quarkus 3.27.4.SP1, Red Hat build of Quarkus 3.33.2.SP1, Red Hat Data Grid 8.6.2, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 and 26 more

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

GHSA-3qp7-7mw8-wx86 — Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

Affected: Maven: io.netty:netty-handler

### Summary An attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions.

### Details `io.netty.handler.ipfilter.IpSubnetFilterRule#compareTo(java.net.InetSocketAddress)` method performs a bitwise AND between the incoming IP address and the configured networkAddress, instead of the subnetMask.

### Impact Access Control Bypass. Attacker can bypass IpSubnetFilter IPv6 access controls.

Most recent entries from all

CVE-2026-44249 — Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

GHSA-3qp7-7mw8-wx86 — Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking