Loading vulnerability…
IPv6 Subnet Filter Bypass in Netty netty-handler
CVE-2026-44249 is an IPv6 subnet-filter bypass vulnerability in Netty's netty-handler component. An incorrect masking operation in IpSubnetFilterRule.compareTo() causes IPv6 subnet rules to be evaluated incorrectly, allowing valid public IPv6 addresses to bypass subnet-based access restrictions. The vulnerability affects the 4.1 branch before 4.1.135.Final and the 4.2 branch before 4.2.15.Final.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote attackers can evade IPv6 subnet-based access controls and potentially reach application services or resources that those controls are intended to restrict. Subsequent confidentiality, integrity, and availability consequences depend on the exposed application's functionality and independent security controls; the vulnerability does not itself establish arbitrary code execution or bypass of application-layer authentication.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Vendor bulletins for affected HCL products explicitly provide no workarounds or mitigations.
Patch, then assume compromise.
Upgrade io.netty:netty-handler to 4.1.135.Final or later in the 4.1 branch, or 4.2.15.Final or later in the 4.2 branch. Update related Netty dependencies consistently. For products that bundle Netty, install the vendor-supported release containing the fix rather than replacing bundled libraries independently.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
60 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.