PT-2026-47545 · Maven · Io.Netty:Netty-Handler

Published 2026-06-08 · Updated 2026-06-08

OSV

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

An attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions.

Details

io.netty.handler.ipfilter.IpSubnetFilterRule#compareTo(java.net.InetSocketAddress) method performs a bitwise AND between the incoming IP address and the configured networkAddress, instead of the subnetMask.

Impact

Access Control Bypass. Attacker can bypass IpSubnetFilter IPv6 access controls.

Fix

Improper Access Control

Weakness Enumeration

CWE-697

CWE-284

Related Identifiers

GHSA-3QP7-7MW8-WX86

Affected Products

Io.Netty:Netty-Handler

References · 5

• https://osv.dev/vulnerability/GHSA-3qp7-7mw8-wx86 · Vendor Advisory
• https://github.com/netty/netty · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.15.Final · Note
• https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86 · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.135.Final · Note