High [CVE-2026-62243] TLS hostname verification bypass via OpenSSL client path misconfiguration
This high-severity Red Hat Linux advisory covers CVE-2026-62243 affecting Red Hat AMQ Broker 7.13.6, Red Hat AMQ Broker 7.14.1, Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+).
In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.
This could lead to sensitive information disclosure. Red Hat products ship io.netty:netty-handler as a transitive dependency across multiple middleware and platform products.
While the CVSS score reflects the severity of a successful exploit — full confidentiality compromise of TLS-protected traffic without authentication — the vulnerable code path requires three conditions simultaneously: explicit OpenSSL provider configuration, a plain X509TrustManager, and a Java 25+ runtime.
Most Red Hat product deployments use the default JDK SSL provider and currently run on Java 21 LTS, making the vulnerable configuration uncommon in practice. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Weakness: CWE-295.
- 4.2.0
- 4.2.16
- 4.1.136
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
- 4.2.17
- 4.1.137
- netty-handler
- rhbk/keycloak-operator-bundle:26.4.16-2
- rhbk/keycloak-rhel9:26.4-26
- rhbk/keycloak-rhel9-operator:26.4-26
- keycloak/rhbk-openshift-rhel9
- keycloak/rhbk-rhel9-operator
- rhbk/keycloak-rhel9
- rhbk/keycloak-rhel9-operator
- rhbk/keycloak-operator-bundle:26.6.7-3
- rhbk/keycloak-rhel9:26.6-20
- rhbk/keycloak-rhel9-operator:26.6-20
- eap8-activemq-artemis-0:2.40.0-8.redhat_00024.1.el10eap
- eap8-apache-cxf-0:4.1.7-1.SP1_redhat_00001.1.el10eap
- eap8-artemis-wildfly-integration-0:2.0.5-1.Final_redhat_00001.1.el10eap
- eap8-bouncycastle-0:1.85.0-1.redhat_00001.1.el10eap
- eap8-cryptacular-0:1.2.7-1.redhat_00002.1.el10eap
- eap8-eap-product-conf-parent-0:801.8.0-1.GA_redhat_00001.1.el10eap
- eap8-hibernate-0:6.6.54-1.Final_redhat_00001.1.el10eap
- eap8-httpcomponents-asyncclient-0:4.1.5-5.redhat_00008.1.el10eap
- eap8-ironjacamar-0:3.0.22-1.Final_redhat_00001.1.el10eap
- eap8-jackson-annotations-0:2.18.9-1.redhat_00003.1.el10eap
- eap8-jackson-core-0:2.18.9-1.redhat_00003.1.el10eap
- eap8-jackson-databind-0:2.18.9-1.redhat_00003.1.el10eap
- eap8-jackson-dataformats-text-0:2.18.9-1.redhat_00003.1.el10eap
- eap8-jackson-jaxrs-providers-0:2.18.9-1.redhat_00003.1.el10eap
- eap8-jackson-modules-base-0:2.18.9-1.redhat_00003.1.el10eap
- eap8-jackson-modules-java8-0:2.18.9-1.redhat_00003.1.el10eap
- eap8-jakarta-xml-bind-api-0:4.0.5-1.redhat_00001.1.el10eap
- eap8-jaxb-0:4.0.7-4.redhat_00001.1.el10eap
- eap8-jaxbintros-0:2.1.0-1.redhat_00001.1.el10eap
- eap8-jboss-logging-0:3.6.3-1.Final_redhat_00001.1.el10eap
- eap8-jboss-remoting-0:5.0.31-1.SP2_redhat_00001.1.el10eap
- eap8-jbossws-api-0:3.1.0-1.Final_redhat_00001.1.el10eap
- eap8-jbossws-common-tools-0:2.2.0-1.Final_redhat_00001.1.el10eap
- eap8-jbossws-cxf-0:7.4.0-1.Final_redhat_00001.1.el10eap
- eap8-jbossws-jaxws-undertow-httpspi-0:3.0.1-1.Final_redhat_00001.1.el10eap
- eap8-jbossws-spi-0:5.1.0-1.Final_redhat_00001.1.el10eap
- eap8-jsf-impl-0:4.0.11-2.SP1_redhat_00001.1.el10eap
- eap8-log4j-0:2.25.4-1.redhat_00003.1.el10eap
- eap8-neethi-0:3.2.2-1.redhat_00001.1.el10eap
- RHSA-2026:66545
- RHSA-2026:66488
- RHSA-2026:71675
- RHSA-2026:68276
- RHSA-2026:68280
- RHSA-2026:68277
- RHSA-2026:68278
- RHSA-2026:69296
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
Mitigation checklist
- This vulnerability only affects applications that explicitly configure Netty to use the OpenSSL TLS provider (SslProvider.OPENSSL). The following mitigations can reduce exposure without applying a patch: 1) Use the default JDK SSL provider — Do not configure SslProvider.OPENSSL in your Netty SslContext setup. The default JDK SSL provider (SslProvider.JDK) is not affected by this vulnerability. Most applications use the JDK default unless explicitly overridden. 2) Use X509ExtendedTrustManager — If the OpenSSL provider is required, ensure the configured trust manager extends X509ExtendedTrustManager rather than the plain X509TrustManager interface. The extended variant performs hostname verification independently of the Netty wrapping logic. 3) Run on Java 24 or earlier — The vulnerable code path only triggers on Java 25+ where sun.misc.Unsafe-based trust-manager wrapping is unavailable. Running on earlier Java versions (e.g., Java 21 LTS) means the wrapping works correctly and hostname verification stays enabled.
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.