ECHO-f62c-6c16-552e

    Dashboard / Vulnerabilities / ECHO-f62c-6c16-552e

    ECHO-f62c-6c16-552e

    Published: 1 Nov 2026Last Modified: 4 Nov 2026

    Summary: GHSA-p85m-gvr3-788c: hostname verification skipped on the OpenSSL client path with a plain X509TrustManager when trust-manager wrapping is unavailable (Java 25+). Upstream's fix (in https://github.com/netty/netty/commit/9e05192391, 4.1.137.Final) only adds a check at context creation for an endpoint identification algorithm set with SslContextBuilder.endpointIdentificationAlgorithm(...), which netty added in 4.1.112.Final (0deca94aa1); 4.1.74.Final has no such setting. The other way to ask for hostname verification, SSLParameters on the engine, is the same in 4.1.74.Final and in fixed 4.1.137.Final (it sets SSL_CVERIFY_REQUIRED and leaves the check to the trust manager), and the fix does not change it. CVE-2026-50010, patched above, covers wrapping plain trust managers.

    Details:

    References: https://advisory.echohq.com/cve/CVE-2026-62243, https://github.com/netty/netty/security/advisories/GHSA-p85m-gvr3-788c, https://nvd.nist.gov/vuln/detail/CVE-2026-62243, https://www.vulncheck.com/advisories/netty-through-tls-hostname-verification-bypass, https://github.com/advisories/GHSA-c3j3-64rf-grvf

    Affected packages

    Package

    Name: io.netty:netty-handler

    Purl: pkg:maven/io.netty/netty-handler

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -4.1.74.Final+echo.4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High