High [CVE-2026-62243] TLS hostname verification bypass via OpenSSL client path misconfiguration
This high-severity Red Hat Linux advisory covers CVE-2026-62243 affecting Exploit Intelligence, OpenShift Serverless, Red Hat AMQ Broker 7.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+).
In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.
This could lead to sensitive information disclosure. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Weakness: CWE-295.
Affected products named by the advisory: Exploit Intelligence; OpenShift Serverless; Red Hat AMQ Broker 7; Red Hat build of Apache Camel 4 for Quarkus 3; and 22 more.
- 4.2.0
- 4.2.16
- 4.1.136
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
- 4.2.17
- 4.1.137
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation
Upgrade to a fixed release: 4.2.17, 4.1.137. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.